While this isn't terribly common, I know that SQL Injection is still possible with a parameterized query, if you are calling a stored procedure that uses a parameter to construct and execute dynamic SQL.
I'm curious if there are any other edge case scenarios where SQL Injection is still possible even if you are using parameterized queries? Is dynamic SQL the only catch?