If I'm not mistaken, custom_json can be used to suck up arbitrary JSON, and any user can write to custom_json. But I think that there was some complication to this. I'll let you know if I recall.