Raymond Chen has an interesting post about a program that tried to open a file, got back an error code, and used the error code as a file handle. In this particular scenario everything worked, but completely by accident.
Reading it, I remembered back to my own "bug from hell" related to file handle.
The scenario: I was working on NuMega's BoundsChecker in the very early days of Win32. BoundsChecker forces its DLL into the target process very early in the target process lifetime. The BoundsChecker DLL then writes various messages to its output file.
One particular program (SourceSafe) had some old dead DOS code that immediately closed the three standard handles (stdin, stdout, stderr) to free up as many handles as possible.
Imagine what happens in this scenario:
Imagine the havoc this creates. Both BoundsChecker and SourceSafe are writing to the same file handle (1). They're writing completely different data. The upshot in this case was that the SourceSafe database got completely corrupted.
Man, did I take a lot of flack for that one!