In theory its possible to have quite arbitrary attacks doing "anything" - it not even have to be magic. There's some funny construct, overrideattack() builtin, that invokes arbitrary script, and script knows 1) who're you and 2) what you've been to attack. It can do really arbitrary logic...