It is a bad idea to plug untrusted hardware into your computer. Many Windows users have autorun enabled, so could be infected with malware as soon as they plug it in. This has been exploited by people pretending to run promotions and handing out infected USB drives in front of targeted businesses.

Worse than autorun, there have been buffer overflows against USB drivers and proof-of-concept exploits that allowed Firewire devices to read arbitrary physical memory through DMA access. I haven't seen this used in practice, but the risk is there. Bruce Schneier wrote about these attacks a few years ago: http://www.schneier.com/blog/archives/2006/06/hacking_comput...

If you want to go down the Ken Thompson "Trusting Trust" hardware security rabbit hole, think about who manufactured your computer.