If we examine the code, you can see that the designer you have an open (public), the attribute $fields you do not set the attribute binding to transfer there just an array, so I can create his own instance of this class and pass there anything! This is not the correct behavior of the class, if you do not check the input parameters.