I think you should have reported this as a MiniBB vulnerability (and I'm assuming you have). I don't know if I would really classify this as an issue with the PHP function, though it may require looking into. I recently discovered similar behavior in Windows resolving applications. I can't be certain that the Windows resolver itself is the culprit, as I haven't tested (maybe one of you would like to do so), but when using the "/dns" command in mIRC, a tab and other special characters as an argument (preceding valid input data) seems to return the local host name. I'm not sure whether that's expected behavior, but it's very similar to this, only less relevant to the security of a particular application.
