You can also find various stories of AVs detecting perfectly clean Hello World programs as "malicious". One example I remember particularly clearly was a beginner who had just downloaded GCC and was starting to learn C, and wondering why the executable kept disappearing. It was his AV. Ironically, the same code compiled with MSVC didn't get detected...

The other category of software that frequently gets false positives are demoscene productions, which admittedly do push the boundaries and can involve things like custom packers and unorthodox API usage, but are certainly not malicious by any definition. Of course there's also the cracks/patchers/keygens, which are not malicious to the user but are often detected as such anyway.