`str_shuffle` introduces randomness and thus makes the result unpredictable. Assuming `str_shuffle` does not prevent predictability (and `MD5` and `microtime` are predictable, as they are) a brute force attack on the password reset hash can reveal the original password. Since the hash is available this can be done very rapidly. If you still see a security risk feel free to elaborate. You may do so via mail, if you want.