Looking at the patch that fixed the vulnerability [0], I think it's a pretty safe bet to say that having a hybrid array/key-value store [1] is a generally terrible idea.
[0]: https://www.drupal.org/files/issues/SA-CORE-2014-005-D7.patc... [1]: http://php.net/manual/en/language.types.array.php