Anywhere you accept JSON from untrusted users, you should be catching parse errors anyway.