As someone working on Mozilla's WebGL implementation, I assure you that WebGL is not just about passing OpenGL calls "unfiltered" to the driver. In fact, an implementation doing that could not even pass the standard WebGL conformance tests.
The proof-of-concept is really just painting 10,000 rectangles the size of the window. It's that stupid. It has nothing to do with shaders or anything fancy. As long as you allow painting many large triangles as a single GPU command, you have the vulnerability. If you don't allow that, then you're not fast.
Everybody has known forever about that vulnerability in 3D APIs. So there was not much of a point using a private reporting mechanism. However, Microsoft took this well-known universal vulnerability and presented it as something specific to WebGL. There was no point in replying privately to that.
It just renders 10,000 rectangles of the size of the browser window, which by itself is enough to DOS; to make it a bit worse, it also uses a large texture and adresses it with very little respect for memory locality ;-)
They closed my bug as "fixed" but didn't give any details. I'll have a look at it again when the next beta / final build of silverlight 5 comes out. In the WebGL WG we are very confident that this can't be fixed without working with GPU vendors on new robustness features in the drivers.