A URL spoofing bug in Firefox, reported 2 years ago and it's still working