Man the JSON inconsistency one is creative. I know it's not consistent implementation across languages, but I don't know it can be used to such attacks.
Yes. The big take-away for me, whether it's JSON or YAML or XML or whatever: never parse anything more than once (and definitely not with different parsers).
