I have recently watched this video of a Finnish internet security expert. Somewhere around eleventh minute, he talks about a virus which is hidden in an image and executes
It does not have to be displayed, it has to be read.
The OS might have a thumbnail generating thread that will parse all images it finds. A buffer overflow in that code will allow code execution without user intervention.
This goes for any file that has any form of automatic read feature, to extract properties of a mp3, index a PDF, etc.