This question already has an answer here:
- What could an “<img src=” XSS do? 8 answers
An image can be displayed through a .php source if the source has a proper header (as per the answer to this question).
If a website allows
something.php that will also run when the hosting site retrieves the image? (This seems like it could open things up to a possible XSS)