We use a https://github.com/jenkinsci/stash-pullrequest-builder-plugin/ successfully (it works), with a build somewhat newer than the official Git head (so including the fix above for 1.7.0), however error messages are logged about passing variables into the build which are not the job's official build arguments. As one corollary, we also can not quickly "Rebuild with Arguments" the same job setup, though in case of this plugin it is just an annoyance - rescheduling a PR build goes via posting comments to the PR in Stash.

In fact, there still was a practical problem: those warnings swamped our Jenkins master log partition on one occasion faster than the logs were rotated away, causing a server outage, so then we've seen them and set an appropriate `-Dhudson.model.ParametersAction....` into the configuration (`/etc/sysconfig/jenkins` in our Unix/Linux case).

• Also reported to https://wiki.jenkins.io/display/JENKINS/Plugins+affected+by+fix+for+SECURITY-170 as asked on IRC.
• As suggested generally on IRC,
  >> "Variables" are fine, but such variables should not be passed as Build parameters. The best way is to rework the plugin to pass an EnvironmentContributingAction when triggering the build.