I don't remember the exact details, but a few years ago there was a Perl module that did something like:

   my $path = something_that_can_return_undef_on_failure;
   `rm -rf /$path`;

during the execution of its test suite. The author didn't catch it in testing because he never ran "make test" as root (who would?). But people on the Internet ran "make test" as root, with disastrous consequences.