Back at MFIF I was shown that someone could create and post an image that when viewed would log the viewer out of the forums, and was advised to keep the image tags disabled. I don't have the know-how to test whether UBBT still has that vulnerability, so the image tags remain disabled here also.
