Comments and content-length limits of graphics formats and the like are sometimes used nefariously. In some web applications, you can easily upload a GIF file (or in others a file with the .gif extension which is assumed to be safe since it's that extension) but not something that looks like a PHP script (or not that has the .php extension in some cases).
Since GIF allows the trailing content and PHP passes data that's not within its tags through to output unchanged, some applications will be fooled into accepting GIF files with PHP inside which act as both GIF and PHP scripts. Then the other half of the attack is just to convince the system to treat it as PHP, which for the purposes of this post is left as an exercise.
