Security Risk?

[Manfred Nowak]

When a procedure gives a class instance for processing to a module mod

  class CPP{ int i; /+ ... +/}
  auto d= new CPP;
  d= mod.process( d);

that processing is currently able to hide additional data and methods 
in that class instance.

Is somebody able to show that such hidden data and methods cannot be 
used to endanger the whole system?

-manfred