Taint checking would not catch this. This may change in 5.10. That's a long time from now.