Well, I don't know if it's really a bug unless you're coming across that URL naturally. You can modify URLs on the site (and any site with scripting) to do all sorts of weird stuff. I can put in an extra database check if it's causing panic and terror in the streets, but I don't really see why it would.