CRLF Injection in mail()

Maybe I'm behind the times, but I just found out about this one today. Basically if a user can take your form that sends an email, and send a value like "This is my subject\nBcc: myemail@myisp.com" for the subject, then they will get Bcc'd on every email your script later sends. One method to use is to download your form (Save As), modify the usual 'text' box into a <textarea> and put in a value like that given above. Note that it has to be an actual line feed (like in a textarea), not just a \n typed in (that'll get escaped by magic_quotes, hopefully). Where this comes into play as "bad" is when you're trying to hide email addresses, and now the user can Bcc: themselves on everything sent out and find out the email address of everyone. Why isn't, or is this, considered a bug? Is there any valid reason for PHP not to check for this itself and say that Subject (and whatever other fields are vulnerable) can only contain a subject header and that's it? What do you think? ---John Holmes.