unsafe.diff

diff --git a/src/core/instance.h b/src/core/instance.h
index 929405e..8d63bf8 100644
--- a/src/core/instance.h
+++ b/src/core/instance.h
@@ -180,6 +180,9 @@ struct MVMInstance {
     MVMint8 spesh_inline_enabled;
     MVMint8 spesh_osr_enabled;
 
+    /* Flag for disabling unsafe operations. */
+    MVMint8 unsafe_disabled;
+
     /* Flag for if NFA debugging is enabled. */
     MVMint8 nfa_debug_enabled;
 
diff --git a/src/core/interp.c b/src/core/interp.c
index 185fe90..67ceb07 100644
--- a/src/core/interp.c
+++ b/src/core/interp.c
@@ -23,6 +23,12 @@
 #define NEXT runloop
 #endif
 
+#define OP_IS_UNSAFE \
+    if (tc->instance->unsafe_disabled) { \
+        const MVMOpInfo *info = MVM_op_get_op(op); \
+        MVM_exception_throw_adhoc(tc, "Operation '%s' is unsafe you useless lump!", info->name); \
+    }
+
 static int tracing_enabled = 0;
 
 /* This is the interpreter run loop. We have one of these per thread. */
@@ -3796,6 +3802,7 @@ void MVM_interp_run(MVMThreadContext *tc, void (*initial_invoke)(MVMThreadContex
                 cur_op += 2;
                 goto NEXT;
             OP(openpipe):
+                OP_IS_UNSAFE;
                 GET_REG(cur_op, 0).o = MVM_file_openpipe(tc, GET_REG(cur_op, 2).s, GET_REG(cur_op, 4).s, GET_REG(cur_op, 6).o, GET_REG(cur_op, 8).s);
                 cur_op += 10;
                 goto NEXT;
diff --git a/src/moar.c b/src/moar.c
index a699954..22c253f 100644
--- a/src/moar.c
+++ b/src/moar.c
@@ -139,6 +139,8 @@ MVMInstance * MVM_vm_create_instance(void) {
             instance->spesh_osr_enabled = 1;
     }
 
+    instance->unsafe_disabled = getenv("MVM_UNSAFE_DISABLE") ? 1 : 0;
+
     /* JIT environment/logging setup. */
     jit_disable = getenv("MVM_JIT_DISABLE");
     if (!jit_disable || strlen(jit_disable) == 0)