GET requests should not have any significant side-effects, unfortunately some do not follow that rule. I once read a story of a whole database getting wiped, because a spider "clicked" on every "delete" link.

Idempotence is not enough, it only requires at executing a request a second time (with no other changes in between) has no significant effect, the first time is allowed to have a significant effect. PUT requests are the typical example.