In reply to Peter Cralen.

Not really a "vulnerability", as such. Mainly it shows that regular expressions are very, very powerful, and shockingly easy to get wrong. Sometimes in interesting, potentially amusing, ways.

Test cases help, but they can only test things you have thought of before. :)