These are all in the category "Lisp code does something silly, the
image code breaks".

(let ((l `(image :type xbm :type xbm :height 1 :width 1 :data
,(bool-vector t))))
  (insert-image l))

inserts an image. It should consider the spec erroneous.
--
(let ((tail (cons :invalid nil)))
   (setcdr tail tail)
   (insert-image `(image :type xbm . ,tail)))

causes an infinite loop. It should be considered invalid.
--
(insert-image `(image :dummy :type :type xbm :height 1 :width 1 :data
,(bool-vector t)))

produces an error. It should arguably behave the same as

(insert-image `(image :dummy :dummy :type xbm :height 1 :width 1 :data
,(bool-vector t)))
--
(let* ((circ1 (cons :dummy nil))
       (circ2 (cons :dummy nil))
       (spec1 `(image :type xbm :width 1 :height 1 :data ,(bool-vector
1) :ignored ,circ1))
       (spec2 `(image :type xbm :width 1 :height 1 :data ,(bool-vector
1) :ignored ,circ2)))
  (setcdr circ1 circ1)
  (setcdr circ2 circ2)
  (insert-image spec1)
  (insert-image spec2))

livelocks emacs somehow. It should...I don't know. Abort because the
spec is circular? Not compare specs using Fequal?
--
(insert-image `(image :type postscript :pt-width 100 :pt-height 100
              :ascent 0
              :bounding-box (0 0 100 100) :file "dummy.ps"
              :loader ,(lambda (frame spec width height id colors)
                 (setf (plist-get spec :ascent)
                       -1))))

livelocks Emacs in the display code. It should automatically switch to
the buffer called "image.c" and rewrite the code there not to call
Lisp.
--
These probably aren't worth fixing in their own right, but someone
might think image.c is a good place to take plist handling code
from...

I think with the exception of the contrived last example, these are
all easy to fix, but a bit harder to fix well. I've tried to do the
former, for now, but I'd welcome any help for me to do the latter.