Although personally I don't care for this program. However, as computer security minded professional, reporting a detailed security defect and exploit on any product in an open forum such is this, is not good practice. It is not fair for the developers and more importantly it is not fair for the people who have brought such products. The normal practice is to notify the developer of the issue and give them time to fix the issue. If they do not respond and fix the issue in a timely manner (uusally 30 days) then other avenues can be taken such as reporting it to specialized companies such as Securnia

To answer your second question. Truecrypt does not hide data inside of applications, pictures, mp3's etc. In my opinion, this is overkill and for the un-informed. Also there are programs out there that can scan for abnormalities in different file formats such as this.

People are better off leaving all the smoke and mirrors behind and simply using a known and reputable encryption program.