Yes, that main id grab exploit is public now and it's one I've had on hand for a while (I didn't discover it). I don't have the time or patience to report this stuff to Yahoo! anymore and when they do patch it (like they just did) it almost always is revived (which it has been). The public version still works because of this neglect or care to fix something correctly. Yahoo! will fix it on a single server or single set of servers and leave a giant hole for it to crawl back through. Their loose server infrastructure is a nightmare for getting these kinds of issues correctly (meaning thoroughly) patched properly.