It is an error in YUI, apparently, that has been fixed. Not sure if actual exploit that allows others to manipulate its contents or what, but apparently all it takes is an upgrade to the latest version to fix, which has been done.