I haven't worked out a simple test case yet, but several times while playing with Zach Riggle's question about ZSH_DEBUG_CMD, I managed to put the shell into an infinite loop by redefining TRAPDEBUG() { ... } at the command line without first doing unfunction TRAPDEBUG. This probably requires making a reference to $ZSH_DEBUG_CMD in the function body (and therefore requires DEBUG_BEFORE_CMD) but I'm not certain.