MERGE statement pitfalls include duplicate source keys, concurrency races, trigger surprises, and complex actions that deserve testing.