We received legacy project for support and fixing.. it had few issues:
1. There was a controller called MainController. This guy was the soul of the project 10k+ lines, heavily dependent on the data from the database.
2. We didnt get the data. Just the database structure (we couldnt run the app at all)
3. At the very end of that controller there was a "simple" eval($_SESSION['somevariable'])
4. We had no documentation and had to guess how it works...

Someone really had fun screwing up this project. Needless to say we got rid of it quickly. :)