Thanks for the tracker link, will keep an eye on it.
And yeah I understand that it works with only the first two parameters supplied, but isn't it best practice to include the hidden fields?
Generally, you will need to supply the first three parameters, while the remaining two are usually fine left default. The second parameter should be a language key used to explain to the user what the confirm box is about. The third parameter, $hidden, should hold html for hidden fields containing all (user-)submitted values needed to get the current script to exactly the state where it is when calling the function.
Anyway this is getting off topic, once again, thanks for the link.