>From a security perspective: Is it required to programmatically check
if a DropDownList Postback 'SelectedValue' actually exists in the
selection list previously rendered to the client? In other words: upon
postback, when the DropDownList control Change event fires and the
'old' ViewState is compared with the 'new' selection (the
posted value) will the runtime throw an exception if the new value is
not defined in the DropDownList loaded ViewState?

Thanks

-Itai