Check for user controller constantize.
See also: http://blog.conviso.com.br/2013/02/exploiting-unsafe-reflection-in.html