Where I work recently disclosed another vulnerability in a similar vein.

https://sra.io/blog/letitgo-a-case-study-in-expired-domains-...

Spooky stuff for sure.