This is a massive gray area.
When someone is looking for a specific example or piece of code, I would say a gist or pastebin of malicious code (the Java 0day exploit, for example) would be the appropriate method.
As far as posting links, especially those known to contain malicious content (even if the content is only plaintext links to malicious code), I think the best policy would be to make all such links in plaintext so that inexperienced or unwary users don't just follow a link that would take them somewhere harmful. This is adapted from WOT's link policy in their forums:
When posting websites and links
Please do not post live links when referencing a website. We do not want anyone to accidentally visit a dangerous site.
Use simple domain names in a format like this:
If you are referencing a URL, change the HTTP to HXXP. For example:
Perhaps it would be a good idea to use a similar policy as far as linking to known malicious content. Links to non-malicious content would still be fine.
In addition, when a user posts links to actual files containing malicious code, such files should be in a compressed folder protected by a password (many security firms use this policy). The user who downloads the file would therefore become liable because he/she would have to take the extra steps necessary to run the code. If the link had led them to a file that would execute upon download, or even if the file would only executed when the user actually issued a command to execute, that could lead to liability issues. We need to take as many steps as we can to minimize the damage to users' computers, especially where Stack Exchange could be considered responsible.
It would also be a Bad Idea to assume that all users know what they're doing when they visit sites to intentionally download and execute malicious code, even though being a part of the site kind of implies such knowledge. It could be stated that Stack Exchange network is not liable for anything that goes wrong due to someone clicking a malicious link (to avoid legal liability for damages, if applicable).
Of course, I'm probably missing something that would help with a better solution to the problem.