I did something like this once. My University had an full screen kiosk browser that was locked down. Well it turns out that you could "customize" Firefox, add in a missing button, get to the print screen and change the executable from "lpr" to $TERM which would immediately pop a shell.
My university let students put procmail files in their home directories to filter their incoming email. I created a .procmailrc file which set a DISPLAY env variable and then spawned an xterm process. That popped up a terminal on the machine I was sitting at with a shell on the mail server which had write access to every student's home directory.
Good times.