The vulnerability was posted to MacRumors forum by a New Zealand iPhone user who figured out a sequence of key taps that rendered the passcode useless.
When you iPhone is locked with a passcode tap Emergency Call, then enter a non-emergency number such as ###. Next tap the call button and immediately hit the lock button. It should open up the Phone app where you can see all your contacts, call any number, etc.
I tested this on my fully patched iPhone and can confirm that it works as advertised.
This isn't the first time the iPhone passcode was disabled by a few key strokes.