You can always trawl through /dev/kmem . . .

PadWalker gives limited access to the pads.

I remember there being a way to get at any pads, but I don't remember how exactly (this isn't something I do every day . . . ). It was in reference to a node on how to break lexically-declared variables for private object data. The process was so difficult that the equivilent ammount of work in any other OO language could also break object privacy. Sorry, that's all I remember.