They don't have to use it directly.
GET / HTTP/1.0
Accept-Language: en;q=2.2250738585072012e-308
If you're running Tomcat and you call getLocale() on that servlet request, you're toast.
GET / HTTP/1.0
Accept-Language: en;q=2.2250738585072012e-308
If you're running Tomcat and you call getLocale() on that servlet request, you're toast.
"q" is more properly represented natively as an integer between 0 and 1000.