Any time you deal with semi-trusted input, like an internal protocol or deserialization. :-)