In includes/acp/acp_database.php there's no check for existence of the tables selected to backup.
This may cause unwanted use of HTML page source to handle table names list, which may cause errors or harmful queries injection into the dump.