And of course code which assumes that the string can only ever contain hex digits is an exploit waiting to happen.
Code which doesn't assume the type of content of a variable but contains a string constant is only exploitable by editing the source file and munging the constant.