Never thought to test a massive string of byte order marks... Extensive testing always misses something.

Testing on real user data could have been done but has privacy issues (now we can't inspect logs to check stuff is working), but even so, the user could have put the offending data in after the testing was done.