In fact this was one of the propagation methods of Stuxnet. It exploited a vulnerability in MS's .lnk file to achieve code execution when removable USB storage was inserted. See p. 29 of http://www.symantec.com/content/en/us/enterprise/media/secur...