If there are more arguments in the URL than the number in the method definition the user should be sent to a 404 not found page. Without this fix (in other words with the current implementation) the user can access website.com/method/bar/foo/baz/etc and the page still goes to method, even if it does not have any arguments!
I tried this little snippet inside invoke method:
// Send the user to a 404 not found page if the number of arguments is greater than
// the number of params the class method has
$method = new ReflectionMethod( $class_name, $path_name );
if ( count( $args ) > $method->getNumberOfParameters() ) {
drupal_not_found();
}
It has some colateral effects, even i dont remember them right now, but you can follow this ideia.