New Spoiler

Here's the problem:

In phpBB, it is possible to enforce constraints on BBCode parameters; namely, {URL} is used in the image path for the spoiler, which requires that a valid URL is passed in that parameter.

In vBulletin, there is no such checking, so this particular BBCode would be open to exploitation and arbitrary Javascript code execution through the URL parameter.

Not happening, sorry.