And just to be clear, when I say "feature" I actually mean "completely broken behaviour," though for a change of pace it's not with the compiler. Probably. Hopefully.
Consider this innocent-seeming code:
<cfquery datasource="dsn_A" name="">
insert into test (s) values (
'dsn_A - record 1'
)
</cfquery>
Every CF app has this (or equivalent) in a million places. Now let's change it slightly to make the string we're inserting dynamic (I'll show the 'getMsg' UDF in a moment):
<cfquery datasource="dsn_A" name="">
insert into test (s) values (
'dsn_A - record 2 #getMsg()#'
)
</cfquery>
So far so good. Now here's the UDF:
<cffunction name="getMsg">
<cfset var get = "" />
<cfquery datasource="dsn_A" name="get">
select count(*) as c
from test
</cfquery>
<cfreturn "(#get.c# records in dsn_A)" />
</cffunction>
What would you expect this to do? Return a string, of course, containing the recordcount of the 'test' table in "dsn_A", and it does this perfectly. It also has the glorious side effect of changing the outer CFQUERY's datasource to "dsn_A". To put that another way, a given query does NOT execute with the datasource passed to the opening CFQUERY tag. Rather, it executes with the datasource passed to the last CFQUERY tag before the closing CFQUERY tag. Don't believe me? Here's a test case:
<cffunction name="getMsg">
<cfset var get = "" />
<cfquery datasource="dsn_A" name="get">
select count(*) as c
from test
</cfquery>
<cfreturn "(#get.c# records in dsn_A)" />
</cffunction>
<cfquery datasource="dsn_A" name="">
insert into test (s) values (
'dsn_A - record 1'
)
</cfquery>
<cfquery datasource="dsn_B" name="">
insert into test (s) values (
'dsn_B - record 1'
)
</cfquery>
<cfquery datasource="dsn_A" name="get">
select * from test
</cfquery>
<!--- one record, as you'd expect --->
<cfdump var="#get#" label="dsn_A" />
<cfquery datasource="dsn_B" name="get">
select * from test
</cfquery>
<!--- one record, as you'd expect --->
<cfdump var="#get#" label="dsn_B" />
<cfquery datasource="dsn_A" name="">
insert into test (s) values (
'dsn_A - record 2 #getMsg()#'
)
</cfquery>
<cfquery datasource="dsn_B" name="">
insert into test (s) values (
'dsn_B - record 2 #getMsg()#'
)
</cfquery>
<cfquery datasource="dsn_A" name="get">
select * from test
</cfquery>
<!--- three records!! (the two for dsn_A, plus dsn_B's second record) --->
<cfdump var="#get#" label="dsn_A" />
<cfquery datasource="dsn_B" name="get">
select * from test
</cfquery>
<!--- one record!! (only dsn_B's first record) --->
<cfdump var="#get#" label="dsn_B" />
In order to run it, you'll need to two DSNs configured ("dsn_A" and "dsn_B"), pointed at two distinct databases, each with a 'test' table containing a single varchar column named 's'.
This was tested on CF8 and CF9, with and without CFQUERYPARAM. I also tested with implicit and explicit datasources on CF9. Same behaviour in all cases. Wheeee…

