This can also be used for social engineering, for masquerading as Telegram interface or system popups to get user's trust. And, of course, for disclosing the identity of users.

Also it might allow intentionally crashing Telegram by allocating too much memory.