Seen here: https://twitter.com/javashell185/status/1166299391335878656
POC sent to security mailing list.