I have some rules for these that have served me well:
1. Never hold locks when you're calling someone back. You have NO idea how the caller is going to abuse you.
2. Be prepared to handle recursion (usually with deferral of some kind, or possibly an error), because at some point the callee is going to call you back.
3. Always provide a 'void*' or some other context to be passed along with the function pointer (or the callee is doomed to use a global).
4. Document what the callee can do. For instance, if you're a timer object making "alarm clock" callbacks, forbid callees from taking too much time before they return; assert if they blow it.