I recently found exactly this vulnerability in a non trivial php app that is pretty widely deployed.. I think it just slipped through.