But there was no user story in which the user typed "../sms"! You seem to be encouraging thinking about scenarios like this in advance, a.k.a. BDUF.