Are you completely sure about this? I've always done something like:

    $album = $form->getData();

after validation. I know objects are passed by reference, but at what point is filtering done if you never call `getData()`?