I only have a few minutes but here are a lot.
In JASS2, a local variable declared in a function using the local keyword is not reference counted when it is popped from the stack at function return. The result is that handles using such a variable can suffer a reference leak preventing a handle index from every being recyclable.
TriggerSleepAction does not wait the quoted 0.1 seconds in multiplayer. Network latency apparently results in it waiting considerably longer than the specified time for no apparent reason. Timers, another method of timing in JASS2, do not suffer this problem and will be accurate between clients.
Unit art that is near the absolute edge of the play field can cause a fatal error if the origin falls outside the play field.
Preload appears to execute command scripts with very poor input validation. It is possible to issue preload statements that are capable of generating or downloading files. By abusing security exploits in other programs or the operating system it is possible to install a worm into a system and thus compromise a system.
BattleNet does not validate custom games if they are logical. It is possible for people to join custom games as artificial (spoofed) names or for custom games to existing without any clients in them. In reality a host server could be used to advertise the same session over multiple servers, some of which are VPN Lans, as there is no internal authentication.
The way terrain mesh deformations are computed are not deterministic across different client builds and configurations. This will result in a game desynchronization between Mac and Windows users if terrain mesh Z is required to compute game state or if users on the same builds have different visual settings for physics (or whatever it is called).
The inbuilt save/load functionality does not correctly store game state. Saving loses critical state information such as timer timeout resulting in broken loaded games unless special effort is taken to store and rebuild the state using triggers. The two known trouble causers are Timers and variables with array index 8191 (which is lost).
Periodic timers that are paused and resumed will become once off timers. The periodic status of the timer will be lost resulting in it firing only once after the remaining time once resumed unless started again.
Timers will still execute their expiry function even after being destroyed. They must first be paused and then destroyed to be sure that an extra call of the function with a dead timer does not occur.
Dependency equivalents can be used to form an infinite loop which will cause WC3 to fatal error.
Tranquillity will continue to heal units even after they died resulting in dead units with life greater than 0.405. This will cause standard trigger checks for if a unit is dead to return a false positive (a unit is alive when it is actually dead).
Due to floating point error it is possible for heroes to lose movement speed and life/mana regeneration from hero attributes if large attribute quantities are involved.
Item abilities that add life and damage do not correctly update applied attribute when their level increases but do correctly remove the appropriate attribute amount for that level. this allows one to permanently modify unit attributes such as life, mana and damage and prevents such abilities being used as hero skills.
Shadow strike when set to 0 second period will apply the damage as fast as the game permits (several times a frame) resulting in excessive resource usage, usually to the extent the game will become a slideshow or apparently freeze.
Setting attack delay to 0 with an animation backswing of 0 will result in 8.3 (or something, the max attack speed) attacks per second but use excessive resources resulting in frame drop, slide show like performance or even apparent game freezes.
It is possible for a timer to be scheduled with a timeout less than a game frame. There is no practical or meaningful reason for this to be possible as it should not affect the results of the game in any way but can waste excessive resources.
Removing Locust does not remove all the unit flag modifications it applied. Units will still be left mostly in Locust mode unless a considerable list of hacky flag changing fixes are applied to it (in which case it still may not be perfect).
Units which have their type modified using chaos get all attribute modifications (tomes, items etc) reapplied to them and left permanently on their statistics.
Using Avatar and such unit type morphing abilities to change non-hero units to heroes and heroes to non-hero units is prone to causing a fatal error.
Non-hero units with inventory slots capable of using items will crash the game when they consume a tome that gives hero attributes.
Items that are consumed on pickup or killed by combat are never removed, instead they are left on the playfield as dead and can be considered a leak unless manually removed using triggers.
Destroying a trigger when event responses are still queued on it can result in a fatal error.
It is still possible to type cast variables using their in-memory values despite Blizzard stating it should not be possible.
Obtaining over 100% magic damage reduction will cause abilities to reheal you instead of making you immune. Any more reduction past 100% is equivalent to magic absorb.
Negative damage (healing) is still reduced the same as normal damage and not treated as healing (which ignores most reductions).
Firing Flaming Arrows past the maximum unit range manually will cause the caster animation to bug into a high speed state. The caster acts the same as usual.
Auto casting arrow skills modifies the unit attack rather than actually auto casting the ability. The result is extra range and cooldown from it is mostly ignored.
Buildings that are moved using SetUnitX/Y have their model and damage interaction area moved but pathing collision and selection circle still remains where it was before the move.
Some sources of damage, such as disease cloud or from goblin sappers, bypasses mana shield and deals direct life damage.
Creating a unit in a crowded area uses excessive resources as a displacement location tries to be determined. Frames may even be dropped as a result.
Using an ability with a target circle that has a stupidly large area of effect (of map wide scale or more) will cause the game to fatal error.
Various bugged art assets can cause the game to fatal error when they are created in view. Modified lightning as an anti-map hack tool is the best known example.
Strings are never destroyed once created. Every unique string will occupy memory until the end of the session and can be considered a leak if never used again.
Object editor data that is translated into a different format can persist between sessions and break future sessions. This is best known from wigitizer and how a game restart is required to play a different map.
Yeh and these were just some of the bugs.