I hate to reply to myself but I have to agree with the Anonymous Monk Who Is Wiser Than Me. On reflection, creating objects from JSON is just way too risky. All it takes is one little slip and the attacker has managed to add code to your object and then it's game over. It's sad, I think my idea has a certain beauty, but the dangers are huge.