diff --git a/test.lua b/test.lua
index 727c90b..f63fb18 100644
--- a/test.lua
+++ b/test.lua
@@ -94,6 +94,10 @@ function minetest.global_exists(var)
     return rawget(_G, var) ~= nil
 end
 
+function minetest.get_player_information(name)
+    return name == "fs6" and {formspec_version = 6} or nil
+end
+
 -- Load flow
 local f = assert(io.open("init.lua"))
 local code = f:read("*a") .. "\nreturn naive_str_width"
@@ -134,14 +138,14 @@ local function test_render(build_func, output, description)
     assert.same(expected_tree, tree, description)
 end
 
-local function render_to_string(tree)
-    local player = stub_player("test_player")
+local function render_to_string(tree, pname)
+    local player = stub_player(pname or "test_player")
     local form = flow.make_gui(function()
         return table.copy(tree)
     end)
     local ctx = {}
-    local _, event = form:render_to_formspec_string(player, ctx)
-    return ctx, event
+    local fs, event = form:render_to_formspec_string(player, ctx)
+    return ctx, event, fs
 end
 
 describe("Flow", function()
@@ -590,6 +594,7 @@ describe("Flow", function()
                     local ctx, event = render_to_string(gui.Dropdown{
                         name = "a", items = {"hello", "world"},
                     })
+                    assert(fs:find("dropdown%[[^%]]-;true%]") == nil)
                     assert.equals(ctx.form.a, "hello")
                     event({a = "world"})
                     assert.equals(ctx.form.a, "world")
@@ -603,6 +608,25 @@ describe("Flow", function()
                     event({a = "there"})
                     assert.equals(ctx.form.a, "hello")
                 end)
+
+                it("uses index_event internally on new clients", function()
+                    local ctx, event, fs = render_to_string(gui.Dropdown{
+                        name = "a", items = {"hello", "world"},
+                    }, "fs6")
+                    assert(fs:find("dropdown%[[^%]]-;true%]") ~= nil)
+                    assert.equals(ctx.form.a, "hello")
+                    event({a = 2})
+                    assert.equals(ctx.form.a, "world")
+                end)
+
+                it("ignores malicious input on new clients", function()
+                    local ctx, event = render_to_string(gui.Dropdown{
+                        name = "a", items = {"hello", "world"},
+                    }, "fs6")
+                    assert.equals(ctx.form.a, "hello")
+                    event({a = "world"})
+                    assert.equals(ctx.form.a, "hello")
+                end)
             end)
 
             describe("{index_event=true}", function()