QNX 2.4 allows a local user to read arbitrary files by directly accessing the mount point for the FAT disk partition, e.g. /fs-dos.
https://exchange.xforce.ibmcloud.com/vulnerabilities/6437
http://archives.neohapsis.com/archives/vuln-dev/2001-q2/0266.html