This issue came up in this question - Are the miners concerned with what the pool operators do with their hashpower?. What can a pool operator do with their miners' hashpower?
Commit double-spends, either themselves or for hire. If the transactions reversed are accepted with 0 confirmations, they don't need a very high hashrate to do this with some effectiveness.
DoS attack on Bitcoin, by including no transactions in blocks and rejecting all other blocks. This requires ~50% to be done effectively.
Similar attacks on alternative blockchain-based currencies, which is easier since they are usually smaller.
Merged mining - not nefarious in itself, but should be done only at the agreement of miners.
Coin mixing - paying generated coins to people in need of fresh coins, receiving from them independent funds to be paid to miners. (Illegal if done for the purpose of money laundering)
Include too few transactions, making it harder for people to have their transaction accepted.
Include too many transactions in a possible future scenario where a transaction fee equilibrium is obtained by a gentleman's agreement not to include transactions too cheaply.
Things unrelated to Bitcoin, such as password cracking (generally possible only with custom mining software).
They can do whatever the contract between the pool miner and the pool operator doesn't prohibit.
Let's say I offer to buy aluminum cans for ten cents apiece. You like the idea of recycling so you sell me your cans. But instead of recycling them I burn them. Did I violate the agreement? No. We had no agreement that the cans must be recycled.
CoinLab, for instance, is going to be providing software in which they buy all the hashing that gets mined and in exchange pays out in credits that can be redeemed with certain gaming companies. That agreement will probably be essentailly no more specific than something to the effect of "posted rate will paid per level of hashing performed". From there, they can do whatever they want with the hashing power, as long as they pay out as agreed to in the contract.
If there's no contract, then there are no such restrictions on what the pool operator can do with that hashing power -- legal issues aside. For example, if the pool operator does a 51% attack and double spends, that is fraud and illegal regardless of what a contract says the pool operator can do with the hashes.