To me it seems, at least in this instance there is not even an exploit needed and the feature apparently is just broken beyond belief.