IIRC you used to be able to exploit xterm using malformed escape codes for setting the window title.