A few methods in the Properties class, such as store and load, are specified to fail if they are called on a compromised properties. Specifically, they will throw ClassCastException on a Properties object that contains non-String key or value.

Looking at the source, storeToXML throws ClassCastException on a compromised properties object which has a non-String key. This is not specified in the spec.