Also a zip is not necessarily harmless. A buffer overrun in a common shareware package like WinZip or WinRar could easily be used to constuct an attack vector.