Sure. When you leave passwords floating around in plain text, bad things will happen too. It's too easy to forget that an obfuscated URL needs to be treated as a password.