Wow, I'm a bit surprised that the folks at Mozilla didn't catch that one. I mean, it doesn't seem like an obscure attack vector. Still, 1.5 has only been out in its final form for a few days, so I suppose a few "doh" moments are expected