Some web servers helpfully remove some sorts of white space, like newlines. '() \n{' will get past many filters, then hit some CGIs behind such servers.

I would worry similarly about some mail headers being helpfully reassembled, then handed to procmail in environment variables.