The other day we saw an article about someone embedding a .zip in a jpeg that survived twitter's thumbnailing. What about doing similar things with the eicar string or other false positives that make antivirus freak out? This seems like it'd be an interesting DoS attack.