In sun.security.x509.AVA, there are 3 places where
} else if (debug != null && Debug.isOn("ava")) {is checked. If it's true, string representations of an AVA object uses \HEX dump for non-printable characters. This is nice for debugging purposes, but the output of a method depending on a debug flag is really not a good idea.
The logic was introduced by Charlie in fix for 4505980. I suggest we always use \HEX. Thanks Max
