When you hit Cancel all link in marketplace to cancel your listing, you land on:

/marketplace.php?action=cancelall&dir=cash%20for%20credits

However using GET parameters for other than read-only operations is not a good idea. When users presses F5 after that to refresh marketplace, his listings will be cancelled again.

My listings were cancelled when I reopened the browser and it loaded the aforementioned URL again. Also, this could be used to trick users to cancel their listing. Imagine following private message:

Hello. Check out the marketplace (example link, DO NOT CLICK, it WILL delete your listings!).

This is not a grievous security hole,  but a hole nevertheless.