And then your text editor might leave a backup copy with filename "xyz.php~" which PHP won't interpret and Apache will happily serve to a curious user as plain text.

So I've heard :-)