The bit.ly long url shortening service has an API that is used by their bit.ly bookmarklet to view past bit.ly url shortenings which technically isn’t a ‘vulnerability’ as it is a potentially dangerous ‘feature’.
I have quickly thrown together an example of what I can do with your bit.ly history. This example only works in Firefox, Safari, and Google Chrome because I only spent a few minutes making it and only tested it in Firefox while I made it.
Update: Fixed it to stop saying “Loading” if you have never used bit.ly. It now gives you a message to use bit.ly on a few long URLs and reload the page.