Seems far more likely to be type coercion, or over enthusiastic validation, rather than arbitrary code execution.