Looks to me like he tried pasting some javascript/HTML into his avatar URL and the browser couldn't understand it. The important thing is that it wasn't parsed and executed.
I can't be sure if there's a bug or not, because he's changed his avatar since then. I know the "SymWinOpen" crap isn't mine though...