When did Polymorph stop pulling aggro?
This change was made in patch 4.2.0:
Many crowd control abilities no longer cause creatures to attack players when they are cast. The creature will not attack the player when the crowd control wears off, and nearby creatures will not become hostile to the player either. However, if a visible player gets too close to the target creature, the creature will remember and attack the player when the crowd control effect wears off. The intent is to make it easier for dungeon groups to manage crowd control assignments and pulling packs of hostile NPCs. The abilities affected by this change are: Hibernate, Entangling Roots, Wyvern Sting (will still cause hostility when it begins to deal damage), Freezing Trap, Polymorph, Repentance, Shackle Undead, Blind, Hex, Bind Elemental, Banish, Seduction.