I didn’t found a complete article or faq or whatever explanation on what user-mode can do and what cannot (in addition to memory accesses).
This generic question arose when I tried to use critical sections. This issue was answered already by Richard in bug #3035224:

This is the intended behavior. Only privileged tasks can disable
interrupts.

So the first restriction is inability to enter critical sections (taskENTER_CRITICAL / taskEXIT_CRITICAL). I think this pitfail should be added to FAQ with following symptom: processor catches hardfault exception in prvRaisePrivilege(). But it would be better if kernel wouldn’t allow task to enter critical section (as bug submitter already suggested) and signal it in user-friendly manner (at least debug assertion may be inserted in vPortEnterCritical()).
Are there any more pitfails inexperienced/unmindful users should be aware of ?

When it is in user mode, it is the cortex core itself that stops you messing with the interrupts, not the FreeRTOS code. Look at the Cortex-M hardware manuals available from arm.com. Anything they say you cannot do from user mode FreeRTOS cannot override (software cannot change the hardware behavior).

I know. I’m reading ARMv7 architecture manual from time to time. But I was turned out to be unmindful user :) In addition, hardware limitations not always imply direct software limitations known by end user. Maybe freertos port uses some internal hardware-specific mechanisms based on user-input actions, which themselves don’t violate any hardware rule directly but have later implicit consequences. User catches fault exception somewhere in freertos innards which is hard to trace back to issue origin. These freertos-related subset of restrictions(pitfails) are subject of this topic.