Mail.ru: [XSS] postMessage в jsapi/button

XSS via postMessage handler in o2.mail.ru...