About a year and a half ago it was a very common vulnerability to find when doing web application assessments. Especially if uploading Excel spreadsheets was somehow involved.

Its less common now that most major parsers are turning this feature off by default though.