Bad code in GuiMLTextCtrl

Location of the culprit :
S32 GuiMLTextCtrl::getTextPosition(const Point2I& localCoords)

U32 x = awalk->xStart;
            GFont *font = awalk->style->font->fontRes;

            FrameTemp<UTF8> tmp( (awalk->textStart - awalk->textStart) * 3 + 1 );
            StringBuffer tmpBuff = mTextBuffer.substring(awalk->textStart, awalk->textStart - awalk->textStart);
            tmpBuff.get(tmp, (awalk->textStart - awalk->textStart) * 3 + 1 );

            U32 bp = font->getBreakPos(tmp, tmpBuff.length(), localCoords.x - awalk->xStart, false);

If anyone was wondering, "awalk->textStart - awalk->textStart" equals 0, and not even the "* 3 + 1" bit seems to help, as "getBreakPos" is being called with a length of... 0.
To boot, its repeated several times. Not to mention it looks overly complicated - what happened to using "awalk->len"?

The bug can be exploited by clicking on a web url in the "About" dialog.