Hash table vulnerability (property overwrite)?
In this sort of a scenario you can access the Hashtable's count property like so:
C:\PS> $ht = @{Count = 99}$ht.psbase.Count1The extended type system in PowerShell offers several different views on an object via these PS* properties. See the PowerShell team blog post for details.