The find command's safe-flag list has been expanded to include -D, -f, -flags, -Bnewer, -Btime, -Bmin, -files0-from, and -xattrname. Additionally, the test/[/[[ builtins now flag -t operands with non-numeric values as potentially dangerous, since bash/zsh can arithmetically evaluate identifiers that may trigger command execution.
Evidence
Expanded find flags (search for "-files0-from", "-xattrname") and test safety (search for "operand is non-numeric")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.