Test for security bug found by @motor23
Use dir() to check attribute existence instead of getattr() to avoid security issue with misinterpreted AttributeError