I'd certainly look for ANYTHING which contains a cross-script call of some kind: using colon, double slash (or backslash) and a standard IP, IPV6 or Domain Name. Do you want to take special care when referencing something that COULD be suspicious?

You may want to look at one of my favorite books on the topic - although it is somewhat aging now (perhaps there is a more-recent version): How To Break Web Software by Mike Andrews and James A. Whittaker. My copy is Copyright 2006.
http://books.google.com/books/about/How_to_Break_Web_Software.html?id=zEWvS-sTiNUC
http://www.qualitytesting.info/forum/topics/pdf-downloadhow-to-break-web

James A Whittaker has a much more recent book which I do not have, called "How Google Tests Software". That might have some interesting information.

And, for fun: http://xkcd.com/327/