This was an undocumented issue with v0.7 ("bug").
And the term v0.7 is being misused here. It really is a pre v0.8 bug, right? i.e., it has existed since day one ... a configuration setting for BDB that has been that way since v0.3 at least, if I read correctly.
Since when was this bug in software? So how long did the testnet have time to discover it?
See above. It was a scenario (a transaction requiring 10,000 locks, or about 5,000 inputs) that hadn't been tested (again, from what conversations I've seen on it).