Hmm, given how massively popular TimThumb is I think one can safely assume that if it can happen to a plugin as widely used as that one it can happen to others as well.