The issues come with the non-randomized hashing-functions, but are better described here:
http://events.ccc.de/congress/2011/Fahrplan/attachments/2007_28C3_Effective_DoS_on_web_application_platforms.pdf

I've created a thread on Liftweb Groups (http://groups.google.com/group/liftweb/browse_thread/thread/870c23057925ccb3) regarding this, David told me to open a ticket.