Not a XSS per se (you can only display html you injected yourself in the URL),
but a bug (which is fixed now :p)