You are right that somewhere along the way the regex pattern for trusted images got changed from relative urls to any url. I will fix this for the next release but anyone who is concerned about it can fix it now by looking for this in /Forums/Thread.aspx:

<NeatHtml:UntrustedContent ID="UntrustedContent1" runat="server" TrustedImageUrlPattern='<%# allowedImageUrlRegexPattern %>'
ClientScriptUrl="~/ClientScript/NeatHtml.js">
<%# Eval("Post").ToString()%>
</NeatHtml:UntrustedContent>

and change it to this:

<NeatHtml:UntrustedContent ID="UntrustedContent1" runat="server" TrustedImageUrlPattern='^/.*[_a-zA-Z0-9]+\.(png|jpg|jpeg|gif|PNG|JPG|JPEG|GIF)$'
ClientScriptUrl="~/ClientScript/NeatHtml.js">
<%# Eval("Post").ToString()%>
</NeatHtml:UntrustedContent>

Note that we filter content on the way out not on the way in, we assume that users can find ways of putting in whatever they want, we don't get protection from the wysiwyg editor, anyone can disable javascript and get a plain text area and enter whatever they want. We filter it before rendering.

Best,

Joe