Acidus from Most Significant Bit Labs [1] has released a tool called TinyDisk [2] that stores files in WORM (Write Once Read Many) fashion on a web application. While this is not significant in itself, what is different is that it can save the file in someone else's web app.
By exploring the limits of the site (in this case, TinyURL [3]), Acidus was able to store AES encrypted Base-64 encoded files as URLs in TinyURL's database. Files can be then retrieved by simply asking for the URLs, and reversing the encoding/encrypting process. This is not unique to TinyURL, many sites could be "abused" the same way.
Acidus' presentation "Layer 7 Fun: Extending Web Applications in interesting ways" can be found here [4].
The lesson in this? Always validate ALL input from untrusted sources. Not validating input is #1 on the OWASP Top Ten [5] Most Critical Web Application Security Vulnerabilities.
Links:
[1] http://www.msblabs.org
[2] http://www.msblabs.org/tinydisk/index.php
[3] http://tinyurl.com/
[4] http://www.msblabs.org/tinydisk/extending-webapps.pdf
[5] http://www.owasp.org/documentation/topten.html