Except this kind of attacks: https://en.bitcoin.it/wiki/Double-spending
For example can he simply create a new block that includes some invented transactions that steal money from real address? Without possessing the private keys of those addresses?