The primary issues that we have dealt with in our (very) large distributed environment deploying 2008 DCs and preparing to go to 2008 R2 forest functional level mostly had to do with changes to Server 2008 itself. This TechNet page is a good place to start.
Our biggest issue was with older NAS devices and in-house apps. It's discussed briefly in the article I linked.
Clients that support only the Data
Encryption Standard (DES) will not be
able to establish a secure channel
with Netlogon on domain controllers
that run Windows Server 2008 or
Windows Server 2008 R2. As a result,
unsecure domain join operations will
fail, including operations that are
performed by Windows Deployment
Services and the Active Directory
Migration Tool (ADMT). In addition,
non-Microsoft Server Message Block
(SMB) and network-attached storage
(NAS) devices that do not support MD5
will also fail to establish a secure
If you must support DES, enable
support for Windows NT 4.0
cryptography. Open the Group Policy
Management snap-in, click Computer
Configuration, click Administrative
Templates, click System, and then
click Netlogon. Right-click Allow
cryptography algorithms compatible
with Windows NT 4.0, click Properties,
click Enabled, and then click OK.
Making these changes has some significant security trade-offs, so it's probably best to remediate where you can.
Also, if you have a fairly complex network design the changes to the RPC dynamic ports used by 2008 may cause you some grief, but that is mostly fixed with updated firewall rules.
There seems to be some debate as to whether Exchange 2003 SP2 is really supported in a 2008 R2 forest, but according to Microsoft's Exchange Server Supportability Matrix it is. I'm not really an Exchange guy, so I can't help you much there, but my Exchange guys are asking us to wait until they can deploy Exchange 2010 to avoid any potential issues.