unserialize: Strictly check for :{
at object start
#10214
Merged
:{
at object start
#10214