If anybody wanted to crash a running HFS server he could do that by this way:
Click the at the login field at any of the pages served by HFS and enter a VERY long string (I didn't want to spend time to figure out, how long the string may be, I just did like 2000 chars) into the Name/PWD field. Then click Ok.
Afterwards my HFS pages are no longer reachable. The program itself runs fine, though.
Can anybody confirm that?