[dchest]

You can probably still abuse NSDictionary, causing HashDoS (https://gist.github.com/dchest/4467707). I did it with QuickLook a few years ago; don't know if they replaced a hash function there.