I take it by your lack of response that you're just going to ignore this bug report and leave your users exposed to the privacy issue.

Here's a Youtube video I created of it happening: https://www.youtube.com/watch?v=P30Qi2MSbUQ

I'll be blogging this up unless it's acknowledged and fixed.

I assume that once you've fixed the bug you'll be contacting all of your users to let them know that they've been exposed to this privacy flaw. At least the ones that may have disabled remote content at some point.