If you can compromise someone's account -- someone who doesn't have superuser privileges -- you could then exploit the querystring trick to try to get access to

If you can compromise someone's account -- someone who doesn't have superuser privileges -- you could then exploit the querystring trick to try to get access to additional information. And potentially compromise the account of someone who does have superuser privileges.