The first could be used to perform operations on the wrong database, possibly bypassing access restrictions (I don't think it could access the MySQL internal database because of the underscore, but I could be wrong). The second could be manipulated to access any "functions.php" file in the filesystem, and if you also permit file uploads, this could allow unrestricted code injection. I don't know enough about PHP to know the full range of code injection permitted by the third example, but it looks highly dangerous (eg. passing a function of "system").
The correct way to deal with user input is to develop a whitelist that describes "known safe" input. In the case of
$function, that means a list of acceptable function names; for
mysql_select_db, a list of values for
$table that the user is permitted to access. If you see an invalid value for user input, reject the entire transaction with a suitably vague error message. Anything else is just inviting problems from attackers who are cleverer than you.