I think it's bad that users can raise exceptions in the application by submitting unexpected data, e.g. by submitting a string when an array of a compound form is expected. So they can manually force a page to return http code "500 Internal Server Error" at any time. It's of course not a security issue as only the hacker himself sees the error. But IMO it's bad design because it is not fault-tolerant. And it's also quite wrong that users can externally raise internal errors. Furthermore they can spam the log entries this way.