Prevent href exploit with stacks multipliers

One down.

Fixes #5159