I actually found this bug first in Facebook and later in Google. Facebook said they needed time to think about this and I was hoping they would fix it, so I could not disclose this back then.
Join the club. I've reported it before as well, years ago. I even discussed it on my FB wall at one point with some tests against my own site. I never re-tested, figuring they'd take care of the issue. Guess not.