Also see the infamous Wii tweezer attack which could dump the system ROM with just a pair of tweezers.
Sometimes I wonder how these sorts of exploits are discovered. It must take some serious in-depth knowledge of the target system and a lot of trial and error.