After reading this question about if it's safer to download and compile the source for an open source project or download and run the installer, I thought of another possible vulnerability: is it conceivable a compiler could be designed to leave a back door (or other malware) inside a file it outputs? In other words could the compiler used to compile the source code be compromised? The only way such a thing could be caught would be to dissasemble a compiled executable and compare the code with the original. This would be very difficult.
Also you would need a preexisting compiler to compile an open source compiler. Is it even theoretically possible to have a system that is all open source software and the computer owner (or a group of trusted people) has reviewed the code for the programs used?