If you mean the risk of using php to do some exec or nasty stuff, well if the contributor has access to the CVS or FTP nothing stops him to upload his own script or overwrite my pages.
This is a valid concern and is the reason why IT style template engines have their place.
I am hoping that one day I have a security policy analyzer script which will check php templates if they match a certain security policy (perferably at runtime) but even then it does not have the same level of protection as an IT style template engine.
regards,
Lukas