<?php
// Test nested object in serialized data
class EvilObject {
    public function __toString() {
        system("id");
        return "evil";
    }
}

// Serialize object as value in array
$payload = array("key" => new EvilObject());
echo serialize($payload);
echo "\n\n";

// Simulate what Format::to_xml does
$data = unserialize(serialize($payload));
foreach ($data as $key => $value) {
    if (!is_array($value) && !is_object($value)) {
        // This triggers __toString
        $value = htmlspecialchars(html_entity_decode($value, ENT_QUOTES, 'UTF-8'), ENT_QUOTES, 'UTF-8');
    }
}