If it wasn't PDF it'd be something else. It's everything after the PDF that's alarming here - how did they break out of the app sandbox?