I recently had a bug in Firefox Android which leaked information: after closing a Private Browsing window, if I went to Settings -> Apps, then "Show Cached Processes", then chose Firefox and clicked Stop, to remove it from Android's cache, after opening Firefox again, it would display the closed Private Session from before. Strangely enough, the private session only showed up if I removed Firefox from the cached applications, otherwise it would behave normally (that is, the closed session would not be readily accessible from Firefox).

I was going to report it, but by then version 44 was already available, and it fixed that bug.

But, well, if even Mozilla can make such mistakes, Microsoft surely can too.