There have been vulnerabilities in java and rails caused by deserializing arbitrary classes with given constructor parameters. An attacker just has to find one

There have been vulnerabilities in java and rails caused by deserializing arbitrary classes with given constructor parameters. An attacker just has to find one that (e.g.) accepts a url and a filepath in its constructor and saves the file to that location, and you've (usually) got code execution (by eg overwriting something that gets run frequently).