I think that it's a vulnerability in browser. It was surprise for me, that it's possible to issue POST requests to some completely unrelated website just because dns changed its IP. 127.0.0.1 is one example, but I'm sure that there are billions websites which process POST requests for important actions and their webserver doesn't check "Server:" header. This attack just circumvents origin policy, it's definitely a browser bug.