Actually, exploiting bugs in image parsers has been a classic vector. Certainly tiff, jpeg and BMP to my memory. When i worked at symbian we had an svg parser vulnerability that went underreported.

And given the slew of bugs Google keep finding fixing in libraries like ffmpeg, there are likely lots of bugs lurking in something as complex as an MP4 player...

Yup, most video code has serious bug smell.

Do they from an mp4?

If we're lucky, this also means people like Apple won't autoplay the stuff, so we actually download less data on page load.

What stops you delivering any old mp4 as a gifv?