Long time back (when xhost by default accepted all connections) in my college lab, I used to redirect DISPLAY to an unsuspecting user sitting on my favorite machine and and bombard them with `while true; do xlogo & done;`
I once used a computer lab where the AIX workstations each had their local filesystems exported to the entire campus via AFS. Even /dev. Including /dev/audio. Which was world-writeable. And there was no apparent volume control for the chassis speaker.