Danger, Danger Will Robinson! UTF-8 strings can include overlong encodings (e.g. using 3 bytes to encode a code point that's normally encoded in 1 byte). The

Danger, Danger Will Robinson! UTF-8 strings can include overlong encodings (e.g. using 3 bytes to encode a code point that's normally encoded in 1 byte). The Unicode standard disallows creation of these forms, but until recently (http://www.unicode.org/versions/corrigendum1.html http://www.unicode.org/versions/corrigendum1.html), only "strongly discouraged" interpretation of them. I do not doubt that there is code in the wild which will interpret them as characters.