What can a pool operator do with their miners' hashpower? This issue came up in this question - Are the miners concerned with what the pool operators do with their hashpower?. What can a pool operator do with their miners' hashpower?
Commit double-spends, either themselves or for hire. If the transactions reversed are accepted with 0 confirmations, they don't need a very high hashrate to do this with some effectiveness.
DoS attack on Bitcoin, by including no transactions in blocks and rejecting all other blocks. This requires ~50% to be done effectively.
Similar attacks on alternative blockchain-based currencies, which is easier since they are usually smaller.
Merged mining - not nefarious in itself, but should be done only at the agreement of miners.
Coin mixing - paying generated coins to people in need of fresh coins, receiving from them independent funds to be paid to miners. (Illegal if done for the purpose of money laundering)
Include too few transactions, making it harder for people to have their transaction accepted.
Include too many transactions in a possible future scenario where a transaction fee equilibrium is obtained by a gentleman's agreement not to include transactions too cheaply.
Things unrelated to Bitcoin, such as password cracking (generally possible only with custom mining software).