your mail looks like this...
http://seclists.org/fulldisclosure/2007/Jul/0288.html
http://seclists.org/fulldisclosure/2007/Jul/0290.html
you only put your ayes on the status bar, but the data URL scheme address bar spoofing on firefox isn't your discovering