Insecure Serialization/Deserialization

Serialization: object state to byte stream, i.e. something in RAM being saved to disk.
Deserialization: byte stream to object state, as in something being loaded from a file and then being put into RAM.

I've vaguely heard of attacks relating to serialization/deserialization. Do you know anything about them?

Possible with a vulnerable serializer.