Indeed merlyn has an example that works on many forms of Unix which allows "nobody" to take down a machine using the fact that /tmp is world writeable and there is a regular cron run as root that assumes filenames don't include returns.