@Steve Ebersole (@brmeyer) there's both a test case and a confirmation that this issue still exists below:
I just double checked the source code of hibernate-core\src\main\java\org\hibernate\engine\query\spi\ParameterParser.java and ParamLocationRecognizer.java didn't change much over the years.
The versions I checked are:

• hibernate-distribution-3.6.10.Final-dist.zip
• hibernate-release-4.3.11.Final.zip
• hibernate-release-5.0.2.Final.zip

The notable changes that are actually in the files:

• v3->v4: Java 5 Generics, @Override, formatting
• v4->v5: minor method renames, top-comment update, checkstyle and formatting