If I understand correctly, a constraint "? extends T" is checked at runtime, although in this case it could be checked at compile time (and, yes, it's easy to t

If I understand correctly, a constraint "? extends T" is checked at runtime, although in this case it could be checked at compile time (and, yes, it's easy to tell at compile time that String doesn't extend Number). Also the runtime check is performed on the actual value passed, which in this case is null, and therefore the check "can this cast be performed?" succeeds, but the actual cast fails. So, right now, nobody can show an exploit. But security researchers often manage to find exploits given this much to start with.