Giving a user write access to a directory gives that user write, modify, and delete rights to anything in that directory, regardless the owner or individual permissions of the files contained in it. The webserver user works on behalf of anyone who has access to websites it serves. In most cases, anyone is the general Internet, unless specific security rules are in place. Therefore, anyone on the Internet with basic knowledge could delete and/or modify files, or place undesired content in your directory structure to serve it out.
A recommended solution is to have a writable directory outside the public structure, which a secure script has access to, to write/present content to the public. If you absolutely must have a writable directory within the public structure, I would make it an obscure low-level directory that is never referenced for read purposes to the general Internet. But never the top of your website structure.
Unfortunately, there is no answer to the generic question of how to exploit a web facing server to write to the unprotected file-system. It would depend on the web server and supporting services (e.g.: PHP; JAVA, etc.) and exploits of the particular versions you are running, in addition to any insecure scripts (PHP; CGI; PERL; JAVA) that may be running on the website. The point is, as a web/systems administrator, you should not open write to your disk, putting complete faith in any of the above items to protect you. Also, it would be unethical to propagate such information.