Another fun variant on this is where you're allowed to set a password with special characters that the password validation code later rejects.