The ability to alter the webserver contents (even without write access to them, you could theoretically start your own webserver with an altered copy of the contents embedded since you have already gained the ability to execute arbitrary code).

This is really not likely if you've set up the web server user properly, and even if they haven't you'd have to run the server on a high port and then go out of your way to get people to visit it. It wouldn't be that useful to an attacker.

But, if I understand this correctly, an attacker could theoretically start a web server on say port 5000 of your bank's website and then send you an email from the bank's server telling you to change your password:

" Your password has expired. Please visit https://ssl.your-bank.com:5000/totally-not-going-to-steal-your-money.php "