I once wrote a parameter parsing function for a home-grown web framework (first job, over ten years ago). One of its features was correct handling of parameter arrays, e.g. foo[42][]=bar&foo[42][]=baz would be converted into {foo: {42: ["bar", "baz"]}}.

In my naivety (but laudable desire for code reuse and simple implementation(!)), I parsed the brackets using eval. Without sanitisation.

Parameter parsing using eval. Who would do that?!

Fortunately no-one ever passed foo[42][system("rm -rf .")]=whoops and really ruined our day...

And the worst thing is, this was only noticed by someone in their job interview, when we asked them a question based on our production code. They got the job :)