This was previously due to a variety of potential escape vectors in the AJAX code. There's been a lot of work in this area that's patched those holes. I can't say which specific commit fixed this specific bug, but I can't reproduce this in FF or Chrome at this point, even when launching or terminating numerous instances at once. Marking as fixed until a new repro can shed further light on it.
This was previously due to a variety of potential escape vectors in the AJAX code. There's been a lot of work in this area that's patched those holes. I can't say which specific commit fixed this specific bug, but I can't reproduce this in FF or Chrome at this point, even when launching or terminating numerous instances at once. Marking as fixed until a new repro can shed further light on it.