This is peculiar, because not only is the button secure, but also there should be no GUI update after the recent anti-taint fixes.

Needs more investigation, as I can't seem to reliably reproduce it right now. There also was no entry in the client's taint log, which seems odd to say the least.

Was actually caused by the script handlers, which were (obviously) still running even if the primary GUI update/rendering was stopped correctly. Fixed in 242e9b9.