Object#untaint, untrusted?