ColdFusion's documentation states
Another option available is to use a URL parameter mode=debug. The URL would look like this www.allaire.com?mode=debug. This URL will display debug information whether you have debug information turned on or off in the administrator.
http://helpx.adobe.com/coldfusion/kb/coldfusion-debug-information-using-mode.html
The documentation does not list the ColdFusion version number and it does not seem to work in CF 9.01.
Does this still work? (It sounds like a security risk)
I am assuming that is just old documentation. You are correct, that is a HUGE security risk.
I found this reference and this reference related to ColdFusion 4.5
I found this reference related to ColdFusion 5.0
And here is some old documentation with it as well, from the Allaire days.
I am also running ColdFusion 9.0.1 and adding
?mode=debug
to the URL does nothing.