@TazWake said:
Where it gets a bit muddy is if the server-side code contains a misconfiguration. Then you can have situations where the remote server code is triggering executable code on the filesystem. This getting a bit away from the original question.
After rereading everything I do agree that I gave a bad example. I originally interpreted his question as having more to do with the idea that scripts/programs/etc. can be called from a filepath.