I haven’t checked the source fully, but it looks like the Group Documents plugin only checks files by extension and not something like the mime-type. So there is a chance that someone could do something “dodgy”; though if you have a decent user base, you won’t have to worry about it.
