For unicode security considerations see http://www.unicode.org/reports/tr36/

The report is divided into visual and non-visual security issues. Our old friend RTL override is covered, but mostly in the context of URLs.