RCE on partner.steampowered.com

Summary

Insufficient validation of parameters allowed an attacker to specify the name of a PHP function to call with parameter types (array, array, string). This could be changed to a call with parameter types (string string) using array_diff_uassoc. This enabled calling assert, which at the time invoked eval, enabling arbitrary code execution.