Gosh, that's really, really bad. The absolute last thing I need is for my reverse engineering tools to wantonly execute code out of the (very very likely up-to-no-good) binary I'm reversing.

In general the state of reverse engineering tool security seems pretty bad. Common tools like binutils (objdump, readelf, gdb, etc.), IDA, and even Wireshark have had memory corruption bugs. For example, it's pretty easy to get Wireshark to crash on a NULL pointer dereference in some random dissector when fed arbitrarily naughty pcap data. It's bad enough that I do almost all of my reverse engineering work inside various VMs that have strict isolation from the host. I'd have expected a Java-based program like JEB to be better at this, but apparently they got lazy and decided to just eval() the untrusted binaries...

I would not be entirely surprised if some state-level actor somewhere booby-traps their binaries with exploits like these to figure out who's looking at their stuff.