I think this is a dupe of bug 1457100, which has comments suggesting bug 965637 might be fixing this, but that's in 69 and comment #0 suggests that it works there. It definitely seems fixed in 70 beta for me. Christoph/Dan, can you confirm what's going on here?
Bug 1587976 Comment 1 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
I think this is a dupe of bug 1457100, which has comments suggesting bug 965637 might be fixing this, but that's in 69 and comment #0 suggests that the exploit works there (ie it's still broken). It definitely seems fixed (exploit not working) in 70 beta for me. Christoph/Dan, can you confirm what's going on here?