This security bug was fun.

Reminded me of a boneheaded one I found in Google Video (their old YouTube competitor):

GET "http://video.google.com/docinfo?{"docid":"8794173241407131884"}"

returned

{"success":true,"video_data":{"UniqueKey":"GV_UP:[email protected]:wsb64__46603_TDSDZTk1Ng.wmv",...}