Killing all processes under the user is the expected behavior of kill(-1). That's perfectly fine. Crashing the system is the bug part. From the manpage:

Killing all processes under the user is the expected behavior of kill(-1). That's perfectly fine. Crashing the system is the bug part. From the manpage: If pid is -1: If the user has super-user privileges, the signal is sent to all processes excluding system processes and the process sending the signal. If the user is not the super user, the signal is sent to all processes with the same uid as the user, excluding the process sending the signal. No error is returned if any process could be signaled.