The bug

Since 17w45a's command update, non-op players can use selectors in the /msg command as recipient and in the message. This appears to be the only affected command.

This allows disconnecting other players if the message exceeds the maximum length of a string in a packet.

Also note that a survival player can now simply run /msg @s @e to view all entities, quantify their search with selector arguments, etc. Obviously a non-operator should not have access to this information.