Unauthorized access via Java Web Start

It's possible to pass property name="NAME" value="VALUE"/ with names different from jnlp. and javaws., it allows to leave sandbox...