QR codes are a great way to point people at malmare
Since they aren't human readable, you don't know what site you are visiting until you are already there. It might be a site that is made to look identical to the one you want to visit, but isn't.
There are plenty of available attacks against Android phones that can p0wn them if you can just get the owner to visit a particular website. Even in the latest version of Android, but of course few people have the latest version, especially in China. Getting them to visit your malware infested website is really hard to do if they have to type in the URL, but is simple if you can get them scan your QR code! Who would notice if the QR code part of an ad in a public place with a lot of people like a subway or airport was simply papered over with the rest of the ad left as is?
This is a great exploit waiting to happen in China. We in the west will be mostly immune only because we didn't really adopt QR codes. And that's a good thing.