if i create two contexts, and bind programs to each of them, then it becomes possible for me to use CanvasObjects from each of them on the other. This is not any kind of security or whatever problem -- the issue would appear that it is simply the underlying GL identifier being passed unchecked to the context which just ends up referencing that contexts equivalent resource.
*** This bug has been marked as a duplicate of bug 30981 ***