Fixed twig filesystemloader security issue + test (closes #1026)