Ridiculous security restriction of the day

My message to the admins of Where's George?:

My home page URL is http://steak.place.org/dougo/ but when I enter that into my user profile the "place" gets turned into "noscriptsace", which breaks the URL. This seems like a bug.

Their reply:

The problem is that the software thinks the ".pl" in your domain is a perl script, which isn't allowed to be placed in profiles due to cross-site-scripting vulnerabilities, so the ".pl" is replaced with "noscripts". It's not a bug, but I other than changing the domain or having an alternate, there isn't anyting I can do.

I'm at a loss as to how this is not a bug, but moreover, how could allowing the name of a Perl script in a user profile be a "cross-site-scripting vulnerability"? And let's just hope no one finds a dollar bill in Poland.