Re-allow templating of complex_args, but count params to prevent injection

Fixes #8810