I've gone back and forth on this a lot.

Purists would want us to use exceptions, there's no question about it.

However, from a security and integrity point of view, there's a lot to say about quickly dying out rather than juggling the execution path around. Juggling would create more complex code (more likely to have a security hole), provide extra attack vectors after a threat is established, and increase DOS risks.

So I think our current situation is the best one - we support a toggle to change exit's into throws. This allows code to benefit from exception management if it needs it (e.g. something like the main_include_module block which simulates a request) - while protecting the rest of the system.