Seriously, though…
That’s a pretty huge security hole and I’m surprised nobody bothered to take advantage of it yet.
Tumblr devs, if you’re reading this: I meant no harm by publicizing this vulnerability. I just wanted to amuse some people with spinning boxes, honestly. :)