Minor annoyance really, and the user gets what they deserve (sort of) for being
silly, but it still seems worth reporting.

Recreate by creating a file "foo" with some content. Don't use a file you want
to keep ;^).

then try:  "scp foo localhost:/path-to-file/foo".  Where "localhost" is the 
name of your host, and "path-to-file" is the absolute pathname to the file
you are copying.

scp bombs with 
foo:  I/O error
and the contents of "foo" becomes a copy of the /etc/passwd file. Seems like scp
is dumping its buffer which includes the password file contents. This was
reported to me by some user who has a bunch of hostnames that are similar in
name, thus the user mistake.

Seemed worth reporting. Probably not a security problem as-is, but might be.