Maybe i misunderstood, but I think the bug happened when they merely tried to view the contents of their XML bomb, presumably for legitimate purposes pertaining

Maybe i misunderstood, but I think the bug happened when they merely tried to view the contents of their XML bomb, presumably for legitimate purposes pertaining to their XML work, in the IDE. Triggering the bomb when the hostile XML is merely viewed through the text editor (as opposed to loading it as trusted configuration input) should probably be considered a bug.