How can non-nothing-up-my-sleeve numbers be used to exploit an algorithm? I was watching Computerphile's "Magic 'Nothing Up My Sleeve' Numbers" video where Dr. Mike Pound reasons that the numbers used to create cryptographic functions should not arouse suspicion or contain hidden properties, because doing otherwise would introduce vulnerabilities into the algorithm.

I'm having difficulty conceptualizing how a nefarious agent, N, would exploit numbers that fail to satisfy the nothing-up-my-sleeve criteria. 

The scenario I have in mind goes something like this: N proposes numbers for the basis of a cryptographic function, numbers that contain hidden properties that only N knows about. N goes away on vacation and when he returns to the lab, he finds his team has created a cipher in his absence; he wasn't there for the processes that followed, but what he does know is that his numbers laid the foundation. (I realize the case is probably naive, but hopefully it shows the bridge that I'm trying to build between non-nothing-up-my-sleeve numbers and exploitation.)

How would N's knowledge of what's hidden in these numbers allow him to attack the cipher? How would such an attack play out?
It could be, for example, that this $N$ is a specially crafter prime number, that looks random and safe according to the NIST recommendations, yet discrete logarithms modulo $N$ can be solved considerably more efficiently due to its hidden structure. An attack of this type has been demonstrated last year at Eurocrypt in this paper; it uses a random-looking prime with a hidden structure that makes it especially sensitive to the SNFS algorithm. The team could solve discrete logarithms with respect to a $1024$-bit prime, while the current record for 'normal' primes is 768 bits.