http://www.contextis.com/research/blog/reverseproxybypass/

It is possible for an attacker to reach internal resources in a DMZ if RewriteRule or ProxyPassMatch directives are used in mod_proxy config