In that case I agree that it would never be used as it was written, and suggest that the author must have jumbled the parameters. Calling the method as preg_rep

In that case I agree that it would never be used as it was written, and suggest that the author must have jumbled the parameters. Calling the method as preg_replace($exif['Make'], '', $exif['Model']) would correct the behavior to something useful, while keeping the vulnerability in place.