iOS 8.3 Mail.app inject kit
Interesting bug, but I'd call the title a bit of an exaggeration.  The mail app doesn't 'allow' harvesting Apple IDs, it allows unexpected content to be displayed in emails, and the author shows a proof of concept of using that for relatively convincing phishing.