Well, that is an entire attack surface, on it's own.
https://en.wikipedia.org/wiki/Billion_laughs_attack
https://en.wikipedia.org/wiki/XML_external_entity_attack would be the more relavent link.
alt Hacker News
https://en.wikipedia.org/wiki/XML_external_entity_attack would be the more relavent link.