if (isset($_GET['object'])) { header("Content-Type: nothing/bad-type"); exit(); } ?> PASS - nested image objects with bad mimetype do not cause a crash.