I have XP_CMDSHELL enabled on my staging server only. It enables me to dynamically load a large number source files with various naming conventions and file structures. Like a knife, a useful tool, but should be handled with caution.