I found an application that uses ShellExecute to open hyperlinks. However, it doesn't check if the string is actually a hyperlink - it is passed directly to ShellExecute.
Aside from opening arbitrary URLs (incl. custom registered application protocols, which can be used to exploit vulnerabilities in them), this allows opening any file on the filesystem given its absolute path. I don't think it's possible to launch programs with custom parameters directly.
Aside from relying on vulnerabilties in other apps' custom protocol handling, what's the worst-case scenario of such a vulnerability?