When is a document not a document? Perhaps when it contains executable code. Executable code can do bad things to your computer if it has the security permissions to do so or if it exploits flaws in the way the document readers execute the code. A Word document with AutoRun macros is an executable program in the form of document. A web page containing Javascript (or JScript or VBScript or Java or Flash) is an executable. Without limiting what functionality these executables can access, an action as simple as opening a document or navigate to a web site can open your machine to exploitation.
The latest instance of this is a flaw in Adobe Reader for Windows that allows a specially crafted PDF file to exploit your machine via the mailto protocol link. The SANS Internet Storm Center documents that the PDF mailto exploit documents in the wild, that is, it’s possible for you to catch this nasty bug off a web page or via the mail.
If you’re running Windows and have Adobe Reader installed, make sure you are running the latest version (links are in the article above). And don’t open any files from untrusted sources. And don’t trust any source.