I believe this is related to the "URL handler" exploit that was patched in jaguar early on. similar exploits will hopefully be avoided in vista, or at least patched quickly, as they know that these things happened to OS X several years ago.