It is possible to cause Expect to segfault due to impropper bounds checking. EIP can then be overwritten and the flow of execution changed. It is possible to exploit any script that uses the the Expect program (Scripting lang).