Javascript injection vulnerability

[nobody]

Hi,
I played around with RoundCube webmail demo today and
found out a javascript injection vulnerability in
creation of new folders.
The name of folder is not validated before being
created which allows you to enter folder name as
"<script >....</script>". After the folder creation,
the entire site goes hay-wire.
I understand that by entering junk folder names or
flirting with stuff like SQL Injection or Javascript
injections, a user might only be jeopardizing his inbox
and mails but still I feel the application should
validate user input and stop a user from comitting suicide.