While setting up a master iMac image to deploy across a computer lab, I forgot to disable Front Row. After playing around with Front Row in a restricted, managed account, I found that I could launch iTunes, and from there Safari, even though the account did not have permissions to use these applications! You can read about how I did this in this entry in my blog.
Anyway, if you are in a situation where you do not want people launching Front Row, either delete the Keyboard Shortcut in System Preferences, or (even better) remove the application /System -> Library -> CoreServices -> Front Row.app.
[robg adds: To me, the most interesting part of this hint isn't how to disable Front Row, but rather how it was used to work around application launch restrictions for iTunes and Safari.]
Mac OS X Hints
http://hints.macworld.com/article.php?story=20070128150044924