(1) mpeg4 audio stream decoding, being based on "CSound" - a 1980's audio tool from MIT - is Turing complete, per spec.
(2) mpeg4 has, for backcompat reasons, got a cutout in the spec for embedding MIDI information to be interpreted by spec-compliant decoders.
(3) MIDI, in turn - and again per spec - enjoys a privileged and unauthenticated control channel for the purposes of updating audio device firmware.
So, the spec says playing the wrong audio file might root your hardware.
I'm increasingly convinced that there are profound philosophical questions raised by the fact that unless you go way, way out of your way to prevent a language from being Turing-complete, that Turing-completeness will somehow - and inevitably - find a way to to happen.
"I appreciate SDF but it's a general-purpose server and the name doesn't make it obvious that it's about art." - Eugen Rochko