I saw ;cid= on more than a few occasions. I can't say how recently, and I can't recall the browsing environments, but I saw that string often enough to spark my curiosity long before I saw Steve Diamond quote a URL of this type.
Where, if anywhere, is ;cid= most likely to appear inappropriately? I'm happy to test in a few browsers with some embedded and non-embedded forums created by me.
Re: inappropriate presentation of ;cid= in results of searches of private embedded Nabble fora
The bug that included the cid parameter in permalinks for embedded forums has apparently been fixed. (That was the source of the links I had posted earlier.) But my results, like yours, Graham, also show the cid parameter present in the search results links. Notice, too, that cid is present not only in the links to the posts but also in the link to the forum (where it says in your example "Found 1 matching posts for xylophone in [link to forum] ...").