Which immediately becomes a security risk because classes can overload __getattr__ and __getitem__. So now you're executing random code.
Of course, %s does the same thing (__str__) but at least %s doesn't take any arguments.
Of course, %s does the same thing (__str__) but at least %s doesn't take any arguments.
I'm not worried about executing arbitrary code, because it's not user-supplied and it's normal for a templating library to access attributes of objects you pass to it (if it was unsafe you shouldn't have done that). This is more of a snafu with the number of sensitive and powerful attributes available by default on Python objects.