Specially formed XML stylesheets can be used to fool PCs running Microsoft's spreadsheet application into executing rogue code.

Details here