Didn't they? It sounds strange to assume that nobody ever wondered how this feature might be abused - it's not like that hasn't happened before in the history of browsers.