There aren't any, really - most of the GPIOs are already used. The only possibilities really are the RTS & DTR lines on the serial (DTR also controls the internal debug LED, near the CPU) - obviously it needs buffering, and the output of the serial buffer is *NOT* suitable for direct fan drive!

The temperature sensor internally is not reliable, as it locks itself into a dead state. You're better off having a thermistor controlled fan if you want anything at all.

Hugo