Boost creating folders in webroot on /search after searching for anydomain.com/index.php

There seems to be a quite critical bug with boost on a drupal search form. Steps to reproduce:

1.) Enable boost
2.) goto yoursite.com/search
3.) Enter http://anyDomainYouWant.TLD/index.php in the search form.
4.) Go and check your root - Boost created a folder called anyDomainYouWant.TLD in your webroot.

Therefore it is possible to create as anonymous user an unlimited number of folders in root.

Solution:

I disabled boost for the following urls:

search
search/*

Anybody's able to reproduce this? If you need further information don't hesitate to ask.
Thanks for your help.