Perhaps it's just late and my mind is tired, but it took me a minute to understand what was going on. Maybe a simpler example would be helpful.
Since the delimiters are removed before computing the signature (so each is just "ABCDEFGHIJLM"), the signatures for the following two query strings are the same:
?A=B&C=D&E=FHIJKLM
?A=B&C=D&E=F&H=I&J=K&L=M
So if the value of of the E parameter is controlled by the user, they can construct a value ("HIJKLM") such that the resulting signatures is the same as the signature for a query with a bunch of additional parameters they choose ("H=I&J=K&L=M").
Since the delimiters are removed before computing the signature (so each is just "ABCDEFGHIJLM"), the signatures for the following two query strings are the same:
So if the value of of the E parameter is controlled by the user, they can construct a value ("HIJKLM") such that the resulting signatures is the same as the signature for a query with a bunch of additional parameters they choose ("H=I&J=K&L=M").Clever.