NSPredicate has from the very beginning been the moral equivalent of `eval()`, with all of the security implications that has. Sending arbitrary messages to arb

NSPredicate has from the very beginning been the moral equivalent of `eval()`, with all of the security implications that has. Sending arbitrary messages to arbitrary objects is just fundamentally the thing it does. The addition of FUNCTION() certainly made it easier to turn a security vulnerability into a useful attack, but if an attacker can control the format string passed to NSPredicate (or more generally the construction of a NSPredicate) you always had a security vulnerability.