As long as your server and client are up to date, codes, standards, and framework safety: Yes...
If they're older: No!
Just to be safe: !!!NO!!!
There were a few old bugs that caused issues with this sort of thing on both ends, so we'll approach them both that separately.
Server Side Issues:
Probably not what you're asking for, but I wanted to make sure this gets addressed as well.
In the olden days of flat file servers with upload areas, and some other server side protocols/programs this introduced one very large problem. That problem was the dreaded script injection. By uploading this malformed image they were actually uploading a script that they could then access, and use to gain control of the server, and subsequently a vector of attack against clients as well.
Newer frameworks however have protection for this built in, and if your server programmer is worth anything then they should know about these types of attacks and how to guard against them. This is still a problem even to this day in bad roll your own servers some people keep doing. These programmers may be smart programmers, but sometimes this just falls through the cracks.
On the client side:
For their safety and security, no. It is NEVER okay to allow arbitrary formats for anything. In fact it is never okay to allow a user to do anything arbitrary at all. There is a reason for this, and it is considered a security best policy:
Assume ALL content you personally have not produced to be dangerous
Because of that reason, you should never allow it. Why? Because just like the content being somewhat out of control, client browser versions are completely outside your control. This means that a well meaning person could connect to the place the image is, and get hijacked. Someone would be using your code, website, and functionality to ruin another persons life. You don't want that to happen.
The tentative Yes...:
This isn't such an issue as long as the web/server developer is willing to put in the time, effort, and functionality to safe guard against these attacks and can guarantee that they and their clients are safe from these code injections. That's a lot of work though, so it's a lot easier(not to mention safer for everybody) to just say no.
(you can't tell but the ellipses is italic too...)