A company I recently interviewed for handled assessing my technical skills in a way I found acceptable without having to pay me. I was sent a small Requirements document to program a small app that had nothing to do with their application, but would show off my technical chops. I was told to use whatever language and framework I wanted, but it had to be production ready code. I spent a little over half a day working on it and submitted it. During the on site interview I was given an hour to update the application with new requirements, then I went through a Peer Review as if the code was going out to the customer.

I thought this was completely fair, as I wasn't doing work for them but they were able to receive a fair assessment of my skills through more than, "Write a recursive function to calculate the factorial of a number"

Having an interviewee code on a live code base, whether or not they are being paid, is just a bad idea. They don't know anything about the code or architecture of the project, and aren't as invested in the product as the people actually working for the company are. What happens if the person writes some bad code that works? Do you throw it out? Will it slip through the cracks? What if they change something that was already coded that they don't know breaks something else? Do you not allow them access to the rest of the code base? The questions go on and on, just save yourself the trouble and don't do it. The fake application idea works great