I'm going to try to see, this weekend, what they have in the payload. It might be an innocent mistake. Or, it may be malicious, and then I too will file a complaint.
I may also open a problem with Mastodon. Mastodon should not return a 500 error unless there really is a problem with the server. It probably should be returning some type of 400 error instead. It's possible I didn't configure something correctly, although I think it's likely a Mastodon issue they didn't account for.