I looked at simon’s post and checked the first picture (upload://gzHZGGt5fnTVXIlXDYXwTnrYAtp.png).
It’s upload id 263815, is marked as secure, and the access control post is 1368579.
It’s a PM in which I link to Simon’s post and it gets oneboxed. My inference is that onebox causes the PM to to “take over” the uploads.
I don’t think this will happen unless you have secure uploads turned on, and I suspect the damage is historical (rather than a result of a current bug).