Given the nature of the bug that was exploited, it's pretty unlikely this could have been done by accident. It would have to be deliberate.

The bug, to be specific, is to submit a form using POST in an iframe; the POST response is then able to set cookies. In this case they did the POST in a hidden iframe with no data.