A small follow-on to brilliant past posts by Moshe and Angie:
How to dizzy the next guy
#DANGEROUS_SKIP_CHECK: the most evil of the Form API properties
Since core is mostly frozen, I'm thinking of evil ways to use new features in the Forms API for 6.x.
The one I particularly like is the new FormAPI #type .'_value' callback. And why not - think of the evil that can be accomplished. An otherwise very useful module could form_alter in a value callback that appends the word 'stupid' to every 100th new user name, or shifts node creation dates into the future only on the night of the full moon in order to break search indexing, or changes the names of all taxonomy terms added or edited on Monday morning to be the md5() of the desired name. This could also be accomplished by changing $form_state['values'] in an added #submit function.
In either case, you can disguise your evil by having lots of code in hook_form_alter and then just operating on every form that has (for example) an element like $form['title'] regardless of whether it is a node form or an aggregator item form.