In Tangled Web Michal Zalewski says:
If you are not using path-based parameter passing (such as PATH_INFO), consider disabling this feature.
He gave only one example of this vulnerability. There HTTP response of downloaded file contained
Content-Type: image/jpeg and
Content-Disposition: attachment. Url to file (supplied by an attacker) contained
hello.exe. As the result IE saved file to disk as hello.exe.
What are other attacks that use turned on PATH_INFO exist?