When attachment objects are created they expect a filename and use the unsafe get_oom_string to assign a c pointer directly to a string instead of properly using the safe variant. This would also leak memory.