diff --git a/lib/tests/user_menu_test.php b/lib/tests/user_menu_test.php
index 7167cad6d81..7bd257977d6 100644
--- a/lib/tests/user_menu_test.php
+++ b/lib/tests/user_menu_test.php
@@ -41,6 +41,7 @@ class user_menu_test extends \advanced_testcase {
             array('_____', 0, 0),
             array('test', 0, 0),
             array('#Garbage#', 0, 0),
+            array('privatefiles,/user/files.php', 0, 0),
 
             // These are valid but have an invalid string identifiers or components. They will still produce a menu
             // item, and no exception should be thrown.
diff --git a/user/lib.php b/user/lib.php
index 1010394e435..3b220b24070 100644
--- a/user/lib.php
+++ b/user/lib.php
@@ -712,13 +712,7 @@ function user_count_login_failures($user, $reset = true) {
  * @return array
  */
 function user_convert_text_to_menu_items($text, $page) {
-    global $OUTPUT, $CFG;
-
     $lines = explode("\n", $text);
-    $items = array();
-    $lastchild = null;
-    $lastdepth = null;
-    $lastsort = 0;
     $children = array();
     foreach ($lines as $line) {
         $line = trim($line);
@@ -746,8 +740,9 @@ function user_convert_text_to_menu_items($text, $page) {
         // Name processing.
         $namebits = explode(',', $bits[0], 2);
         if (count($namebits) == 2) {
+            $namebits[1] = $namebits[1] ?: 'core';
             // Check the validity of the identifier part of the string.
-            if (clean_param($namebits[0], PARAM_STRINGID) !== '') {
+            if (clean_param($namebits[0], PARAM_STRINGID) !== '' && clean_param($namebits[1], PARAM_COMPONENT) !== '') {
                 // Treat this as a language string.
                 $child->title = get_string($namebits[0], $namebits[1]);
                 $child->titleidentifier = implode(',', $namebits);