"Undefined behaviour" is a specific term of art in the context of C/C++ and is an euphemism for your whole program state potentially becoming corrupted. With crafted inputs your program can start executing attacker-supplied arbitrary code.
Can you give examples? Dependency Injection seems to be the trend going forward as far as good practices go (Play Framework for instance is migrating to pure Dependency Injection for routers/controllers).
You obviously haven't dealt runtime dependency injection/etc. in Java.
It happens regularly.