Is this a bug or exploit?