[kevincox]

This looks more like an implementation flaw than being easy to abuse. The API is still useful after it is patched.