If said cron was written as a shell script using find to produce a list of files to remove, and then removing them, it would be very easy to make exactly that mistake. And, of course, that would have to run as root, so it is able to blow away your password file.

If you wrote it in C, Perl, or any other "real programming language", you would not confuse returns inside of filenames as breaks between filenames.

Cheers,
Ben