The worst thing about UTF-7 is that it has multiple valid representations of the same string.
I'm convinced that the primary use of UTF-7 is hiding malicious input as different characters [1], as a possible exploit against systems that support UTF-7 for no reason.
