Is it wise to post the mechanics of a bug that could be exploited? Perhaps this should have been a PM?