To anyone with any level of web security experience, the real fix for this (proper escaping) should be obvious.

For every really trivial vulnerability like this that Twitter can't fix, there must be scores of slightly more subtle vulns that go undisclosed.