[semlar]

Originally Posted by MunkDev It's possible because handle:GetChildren() will still return unprotected frames in the secure environment when you're not in combat. Since they are unprotected, they can very well be tainted. It's kind of a trojan horse in the secure environment.

Any frame created by an addon that isn't secure is, by definition, tainted, so unless bagnon is the only thing you're running with a child of UIParent something else would also trigger it.

Here's an example that outputs all unprotected children of UIParent when you mouse over a unit. If you're in combat, GetChildren() will simply not include those frames, it doesn't freak out about a tainted execution path.

local f = CreateFrame('frame', nil, UIParent, 'SecureHandlerStateTemplate')
f:SetAttribute('_onstate-mousestate', [[
    if newstate == 'on' then
        for i, f in pairs(newtable(self:GetParent():GetChildren())) do
            if not f:IsProtected() and f:GetName() then
                print(f:GetName())
            end
        end
    end
]])
RegisterStateDriver(f, 'mousestate', '[@mouseover,exists] on; off')