And just to be clear, NoScript catches these even when it is set to allow JavaScript by default! Running NoScript in "Allow Scripts Globally" mode breaks almost no sites and still protects you against lots of nasty attacks.