While the title refers to "arbitrary data," users can hide whatever they want within Unicode characters, though this seems limited to text. This is different from, say, "arbitrary code execution ...