Currently Varnish attempts to prevent cachebusting on upload.* URLs by stripping query parameters and double slashes. However, that's not enough for thumbnails, where multiple URLs can point to the same thumbnail, by virtue of having a no-op part of the thumbnail URI (the repeated filename).
This could be easily prevented by normalizing thumbnail request URIs further in Varnish.