the user profile consists of a number of pages -most of these have code to check if the viewing user is the actual user and if not redirect i.e. you should not be able to see another users messages so it will redirect to yours (or if youre not logged in will not show anything). However the "home" page of the profile should not redirect as it's intended to show your public profile (and the values shown can be controlled by profile property visibility settings which you can control by editing your profile e.g. I can go to http://www.dotnetnuke.com/User-Profil... and see your profile and the details you choose to share publically.

As such altering the userid does not violate security and using that to view the host/admin does not reveal any sensitive information such as the username or password.

As for role filtering in the membership directory that is not in 6.2.0 release, I believe it will be added soon - perhaps not 6.2.1 as we're focussed on bugs, but perhaps 6.2.2.

no, there is no setting, it should just work  -this is not the first report I've seen of this problem (though most of them mention a threadabortexception in admin->event viewer, which would suggest a response.redirect is being triggered as a condition is incorrectly evaluated) -i thought this was logged but I had a quick look at the 6.2.1 roadmap and can't see it (http://support.dotnetnuke.com/project...)

As I said there were similar problems to this discussed at http://www.dotnetnuke.com/Resources/F... - some of those users resolved it by setting the user profile page under admin->site settings , perhaps you could double check