@waldi
But it's a privileged function.
The vulnerability at play here is that normal JavaScript in a PDF is able to call privileged functions.