I tested this and I have to say this is bug that can become a feature, if improved, rather than just patched out.
The tests I’ve performed were either done using private messages with my partner or in my guild (it’s just 5 of us and we all know each other), none were exposed to possible danger:
I tested external images (websites) and it doesn’t work, it pops out a small yellow square which is very good, or we could’ve seen a really bad spam situation of inappropriate content.
I tested possibility to inject JS in different ways and it doesn’t work at all.
I tested the chance to inject additional attributes with different HTML tags and yet I haven’t found anything dangerous.
We’ve seen people abusing this to troll users by covering their screen with oversized pictures, that is true; but not in my server at least.
Please do keep this feature in the backlog: chance to link smaller icons that can become part of the community emotes.
The few images I put in the general chat came out to be a fun experience for all the online people, I believe this could have a good impact on community features as a whole.