Edit: In your "Downloads", there is nothing particularly special about Java files as opposed to those of similar type and origin. The question asked is more general than the specific case elaborated, and there are general issues to be aware of.
Although I have no experience of Minecraft, security guidelines will typically state that there shouldn't be any potentially malicious code on the machine. There is a long history of one vulnerability allowing a file to be placed at a guessable location on a file system and another vulnerability allowing execution. Even in the old JRE it turned out that stray demo code in the Java Class Library could be executed, and as library classes would have full privileges.
How possibly could the code be executed.
- Code executed as part of the installer.
- Reflection using untrusted sources (this is the main reason why Java Serialisation and similar systems that copied Modula-3 are so bad). You don't even need to run a constructor or method to execute code.
- Injection (i.e. parsing or printing) errors into command strings.
- Deliberate name collisions.
- Some other way I've not thought of - use your imagination.
There have been specific problems with jar files. The ZIP file format has no knowledge of hierarchy, which has lead to directory traversal attacks by starting file names with "../../../../". Many systems pass ZIP with zlib which is not memory safe - even when you think all the memory bugs have been found you can be surprised by another. ZIP files have many uses and other programs may ignore the file extension. ZIP files are typically read from the end (they are an archive format, so the offsets aren't known a priori), which in the past has led to a different executable file format being prepended to a valid and perhaps signed jar (see Billy Rios' GIFAR).
The moral: An "Ah well! That will do." attitude is not ideal for programming. But as always, you may decide that you'll live with the risks.
