Reminds me of the IPv6 "Type 0" routing header disaster, where you could store data in routing loops.

See, e.g. slide 30 of: http://www.secdev.org/conf/IPv6_RH_security-csw07.pdf