It looks like the implementation of
utf8.char uses
string.format with %U internally, which is not implemented in Lua5.1. When calling "string.format("%U", 1)" I get a proper error: "Illegal %U at the end of the format", but when it is called via utf8.char it will just crash for whatever reason.
And for
utf8.codes it seems the secure context functionality doesn't recognize that iter_aux is a public function.