Here's a conversation I had recently with somebody:
A: Why do you check the length of your strings so often and do that much validation of inputs?
Me: It's more secure that way.
A: Why do you need to make you program secure?
Me: Better secure than sorry.
A: It's a useless loss of time.
Me: Bah, it's surprising sometimes the unforeseen problems that it can save.

Here's a good example of an unforeseen problem that might happen, somebody managed to exploit a buffer overflow in OllyDbg and ImpREC.
It happens when an export from a dll has a name longer than the buffer.

CHimpREC does not get fooled by this trick:

Better secure than sorry...