One of my favourites that I ever heard about was from a friend of mine who used to work on safety-critical systems in defense applications. He told me fighter jets have a safety system that disables the weapons systems if a (weight) load is detected on the landing gear so that if the plane is on the ground and the pilot bumps the wrong button they don't accidentally blow up their own airbase[1]. So anyway when the Eurofighter Typhoon did its first live weapons test the weapons failed to launch. When they did the RCA they found something like[2]

    bool check_the_landing_gear_before_shootyshoot(double weight_from_sensor, double threshold) {
        //FIXME: Remember to implement this before we go live
        return false
    }

So when the pilot pressed the button the function disabled the weapons as if the plane had been on the ground. Because the "correctness" checks were against the Z spec and this function didn't have a unit test because it was deemed too trivial, the problem wasn't found before launch, so this cost several millions to redeploy the (one-line) fix to actually check the weight from the sensor was less than the threshold.

[1] Yes this means that scene from the cheesy action movie (can't remember which one) where Arnold Schwartzenegger finds himself on the ground in the cockpit of a russian plane and proceeds to blow up all the badguys while on the ground couldn't happen in real life.

[2] Not the actual code which was in some weird version of ADA apparently.