We should avoid reflective access (especially `setAccessible()`), since this won't work under a security manager.