I'm not sure this is a real issue, but it does highlight the fact that if you combine 1. user-generated content and 2. arbitrary server connections you drastically increase your attack service area