In a general case, the compiler acts as a sandbox. How much harm the malicious code can do depends on the specifics of how much IO it enables.

On the case of Dhall it's entirely safe, if you generalize it into a full OS equivalent system, you'd have to audit everything.