ActiveRecord Association Proxy/Collection create method incorrectly merges attributes

Given the following associated models:

class Client < ActiveRecord::Base
  has_many :orders
end

class Order < ActiveRecord::Base
  belongs_to :client
end

And let's say I have an orders controller in which a Client creates their orders:

class OrdersController < ApplicationController
  def create
    @client.orders.create(params[:order])
  end
end

This mass-assignment, in Rails 2.X.X, would always ensure that the Order Object belonged to the association owner, by forcing the foreign key (client_id) to that of @client.

With Rails 3.0.3, the behavior has changed, making it possible to inject a foreign key simply by setting it. So, in this example, if params[:order] happens to have a :client_id key, that value will override the associations's owner id. In other words, the AR scope that is specified by @client.orders doesn't enforce itself when creating associated objects.

This may also represent a "security" vulnerability, as anyone can easily infer the foreign key column name (Rails makes it pretty easy) and inject a value submitted in a form, that can create objects belonging to other objects that should not be acessible in this way.

Also, calling @client.orders.build(params[:order]) does enforce the correct scope attributes (as would be expected).

I am not familiar with the internals of the new AR querying interface, but having investigated a bit, it all seems to originate in ActiveRecord::Base#with_scope, where improper merging of attributes occurs with construct_scope attributes.