XML bombs