yea there is bug but it seems url doesn't work correctly. see this http://littlehacker.persiangig.com/image/y-XSS.JPG it will redirect to mail's first page