Holland D6 was the first to (accidentally) trigger the bug, but I then successfully reproduced it. I suspect it's a race condition, possibly due to removing bids not requiring a security check and same value bids not being differentiated.
Generic example:
Suppose the auction looks like this:
Bob places another bid at 1.00:
So far, everything seems normal. Notice that both Bob's and Alice unmatched bids are equal to the matched one but have been placed later (this is important). Both Bob and Alice can withdraw their unmatched 1.00 bids.
However, Bob can use this bug to also withdraw his matched bid. To do so, he must open two tabs and withdraw the unmatched 1.00 bid in both tabs in quick succession/simultaneously. NS will then withdraw both the unmatched ask and the matched one, leaving Alice matched with herself:
Sidenote: A probably related (but non-game-breaking) bug is that an ask cannot be removed if it is equal to one that's already matched: