A white paper about the possibility of ajax use in xss attacks
http://barmagy.com/blogs/infinite_lo...07/13/475.aspx

--
Fady Anwar