testing framework access bypass

Here's how I think the bug is demonstrated:

1) I set the user agent in your browser to something like "simpletest1"
2) visit install.php of a D7 site
3) take control of the new installation

This worked for me today using Safari on my laptop. Seems to me like major security hole. I did bring up this concern at one point when the tests were getting added to core, but apparently whatever fix was in place got obliterated.

Karoly responded by e-mail that indeed there was a check for this at one point, but it's gone now. He suggests putting code in install.php to check for this situation, since the tests use install.inc not install.php.

Prior to that response I was brainstorming about possible ways to set a token and a unique key. On possibility would be to make sure the number has at least X digits (e.g. simpletest9999999999_) and then create an empty table with a name like simpletest9999999999_simpletest_token. The code in database.inc could check whether this table/token exists for the incoming user agent in order to validate that it's an expected/permitted simpletest?

An alternative (though I think this would be less secure) would be to write the allowed user agents (or a salted/hashed version to compare against?) to a file.