I was thinking the same thing. Lots of corporations rely on UPNP for printers and the like, so if you were to embed a UPNP spammer in a malicious invoice...