Apache, at least, won't follow a symlink that points outside of the document root. This is for security reasons, as your question implies :).
I'd suggest pointing your symlink to a shared location that isn't necessarily "up" the directory tree. A sibling directory, for instance. If you can modify the server configuration you can add a new entry for that location, otherwise it will need to be somewhere under the document root.
I'm not convinced this question really exists here, as its a hypothetical (as you are not asking about particular server software). The hypothetical answer is yes. There could be a bug/feature of the web server which allows the user to traverse past the symlink and down other parts of the directory tree in an undesirable manor.
I do put to you that the problem is likely to be minor if the server has some kind of cgi/php/active pages as unless the server has some kind of jailing going on it is possible for someone who compromises a website to do this anyway.