Protecting against HTTP HOST Header attacks (prevent your site from thinking it is someone else) | Drupal.org

Drupal 7 added a new feature into core that is not user facing directly, but is sometimes called poor man’s cron. The feature triggers the periodic tasks of a Drupal site like emptying log files, sending e-mails, and clearing out caches. This feature, when combined with dynamic detection of the “base url” (added in Drupal 4.7), can lead to some screwy situations.

Source: Protecting against HTTP HOST Header attacks (prevent your site from thinking it is someone else) | Drupal.org