Calling $class->isa(...) with a tainted class will break things just like mro::get_linear_isa($class).