This isn't an objectively difficult one, but it's certainly one with a fun payoff.

I hacked together a system of file system listeners and named pipes so that I can inject code into a sandboxed app on OSX and have it communicate with the non-sandboxed process that put it there.