how exploitable is it

yeah they patched the browser autocorrect  thing

ill still find out tho

when i saw sammy on my friends list when that happened i thought they were replacing tom

no, spacehey profile customisation is css/html only. if it allowed js tho it would enable you to exploit the site pretty easily. the only way you could probably do some funky stuff is putting malicious links in your profile and praying someone clicks on it lol