taintmark should track individual entries in arrays

[Mrten]

otherwise, if you do

$params['a'] = 'a';
$params['b'] = $_GET['b'];
...
$params['z'] = 'z';

the whole of $params is tainted.