Eric Lippert has a great post describing some of his adventures with security issues in VBScript.  I particularly liked this segment:

“Of course, it could be worse.  There was a bug in early versions of the CLR (which I believe was fixed before the first beta shipped, fortunately) where you could get an error message something like

Path discovery security exception: You are not allowed to determine the name of directory 'c:\foo\bar'

Super! Thanks for letting me know!”