These file polyglots are useful in bypassing the same origin policy in web exploitation. Additionally (badly designed) web parsers and functions will sometimes execute code in metadata fields for these images. Mostly the attack vectors are XSS, but I've seen some more dangerous examples. In other cases I've seen script kiddies just try and shame an AV vendor or try to put them on a blacklist by uploading images like this. Good read!