And yes, I have written a little proof-of-concept exploit to demonstrate this for a particular app. It only took a couple hours.