You should have asked around before posting "SERIOUS...exploit" in the bug forum. It's good that you try to help the community by posting a bug report, especially in the case of an exploit, but this isn't the case.
Asking a few knowledgeable scripters would have been better, as they would have pointed out what qwerty told you. You are always welcome to ask questions regarding scripting in the "Scripts and Popups" section, there are many scripters who could have told you about this re-evaluation of parameters in a timer.
Anyway, the advice here is: investigate your possible bug thoroughly before posting it with such an eye catching thread title.
Greets
