Wouldn't it be fairly easy to get caught doing this? Especially if you did it multiple times, it seems obvious exploits in code you checked in would be traced back to the malicious engineer.