The issue is that the bug leaves a password-less root account available through other means as well. Once you try to reproduce the bug, an attacker could potentially do a remote root login without password.
As such, it's very dangerous for people to try to verify and should be strongly discouraged.
