It's pretty believable to me that _some_ Java deserialization library from the early oughts totally does this as a default behavior.