The NetHack source contains code for several currently unimplemented features. Some of them are marked deferred, so they may or may not make it into the next version. Many of the following features are included in SLASH'EM.
The beholder (e): a type of floating eye (in fact many eyes on stalks coming out of an even bigger eye; derived from Dungeons & Dragons) with 5 gaze attacks: slowing, sleep, disintegration, stoning, and cancellation.
Depending on how the gaze attacks work (none of them are coded yet), the beholder could be an exceptionally nasty enemy.
The shimmering dragon (D): This would leave shimmering dragon scales and let you create shimmering dragon scale mail, which would confer displacement. Monster displacement is not yet implemented, which may be why this dragon is not yet present. There would be corresponding baby shimmering dragons.
Charon (@) and Cerberus are present in the source code if
CHARON is defined, but even if it is, they are both unique monsters which are not placed by any current map. Charon is a very high level peaceful human who, if true to his name's mythology, will ferry the player across the also-yet-to-be-implemented river Acheron/Styx for a fee.
Cerberus is a very high level dog who is tangentially related to Charon in Greek mythology, as the guardian of the gates to Hades. In the SLethe patch, he appears on the final level of the Lethe Gorge.
The spellbook of flame sphere and spellbook of freeze sphere: creates a tame flaming/freezing sphere which will eventually explode at hostile monsters. These spells are fully implemented into SLASH'EM and are starting objects for flame mages and ice mages respectively.
A special artifact attack of magic missiles (analogous to Fire Brand's fire, Frost Brand's cold, and Mjollnir's lightning), has been implemented. The weapon's description, most likely a placeholder, is "imaginary widget".
There is code for "burying" both you and monsters ("The floor opens up and swallows <monster>!"). You can be buried, and stay alive for a while (eventually suffocating), and you have the opportunity to tunnel out.
There is code that gives a 1 in 25 chance of applied bullwhips yanking a monster's weapon away from it, and it hitting you.
There is code that lets monsters use scrolls of fire as a last-resort offense.
There is code for creating force fields over an area of the map.
There is code to give elves a luck penalty for wielding cold iron.
The code for snagging shop inventory from outside the shop (currently requires a grappling hook) has a comment mentioning the possibility of telekinesis. This is partially coded in several functions to do with picking up items. 
There is a comment when using a stethoscope to make sure you have ears and are not deaf. The ears check is not implemented.
There is code regarding invisible objects.
- Defunct features: Features that have been present in some previous version of NetHack but have since been removed.
- monst.c in NetHack 3.4.3, line 351
- monst.c in NetHack 3.4.3, line 1276
- monst.c in NetHack 3.4.3, line 1585
- monst.c in NetHack 3.6.0, line 1859
- monst.c in NetHack 3.4.3, line 2501
- monst.c in NetHack 3.4.3, line 302
- objects.c in NetHack 3.4.3, line 836
- objects.c in NetHack 3.4.3, line 837
- spell.c in NetHack 3.4.3, line 170
- makemon.c in NetHack 3.4.3, line 474
- shk.c in NetHack 3.4.3, line 81
- objnam.c in NetHack 3.4.3, line 2083
- artifact.c in NetHack 3.4.3, line 1000
- dig.c in NetHack 3.4.3, line 1456
- apply.c in NetHack 3.4.3, line 2288
- muse.c in NetHack 3.4.3, line 1083
- region.c in NetHack 3.4.3, line 803
- topten.c in NetHack 3.4.3, line 113
- wield.c in NetHack 3.4.3, line 183
- you.h in NetHack 3.4.3, line 178
- shk.c in NetHack 3.4.3, line 441
- pickup.c in NetHack 3.4.3, line 978
- pickup.c in NetHack 3.4.3, line 1142
- pickup.c in NetHack 3.4.3, line 1238
- apply.c in NetHack 3.4.3, line 215
- obj.h in NetHack 3.4.3, line 83
- monst.c, line 147, monst.c, line 184, monst.c, line 176, monst.c, line 426, monst.c, line 433, monst.c, line 1349, monst.c, line 1423, monst.c, line 1744, monst.c, line 1774, monst.c, line 2063, monst.c, line 2477, monst.c, line 2879, monst.c, line 3220
- cmd.c in NetHack 3.4.3, line 938