In the remote control web interface, I click the link in the "time left" link. The snipe form is properly displayed. I enter a sufficiently large value without any $, then either press enter or click the snipe button. The resulting page contains no markup, just text, though it is sent with HTTP content type of text/html. The text is the local part of the URL, including form parameters, e.g.: activateSnipe?id=270740456790&action=snipe&snipeamount=47 There's nothing relevant getting logged to the error log files.
I notice that any invalid local part behaves the same way, e.g. http://host:port/sadfasdf will display asdfasdf.
This happens with 2.1.5, but has been going on for several versions. Debian amd64 host.
$ java -version
java version "1.6.0_18"
OpenJDK Runtime Environment (IcedTea6 1.8.5) (6b18-1.8.5-1)
OpenJDK 64-Bit Server VM (build 16.0-b13, mixed mode)