I always, always, always go the route of contacting vendors - over the past 15 years I have reported hundreds of security and privacy vulnerabilities. This is the first time where I haven't reported to the vendor first before disclosing.
The way this came about was a bit different, because it started with a tweet[1] where I pointed out that the file was there, and then it gradually developed into realizing that it is a pretty big deal. The discovery happen out in the open. If you look at my timeline and the replies and conversations you will see how it came about.
With hindsight I could have handled it differently, but it just happen to come out in this way. I added an update to the end of the post addressing disclosure. The goal at the moment is to make users aware that there is potentially a big issue here.