This happens only on module removal? I currently find it hard to see an attacker controlled exploitation vector for this issue.