Sendmail prior to 8.6.7 allows local users to gain root access via a large value in the debug (-d) command line option.
sendmail sendmail