How?
Nxt transaction sigs only care about the account id's (not say something like the "genesis block id") so a "clone" (such a test net) in which account #'s that *match* main net (most likely due to using the same password) means that you can *steal* NXT by just broadcasting a test net tx on main net.
(this issue will also apply to "parallel chains" if and when implemented)