The E4X implementation in Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 exposes the internal "AnyName" object to external interfaces, which allows multiple cooperating domains to exchange information in violation of the same origin restrictions.
https://bugzilla.mozilla.org/show_bug.cgi?id=322312
http://secunia.com/advisories/18700
http://secunia.com/advisories/18704
http://secunia.com/advisories/22065
http://securitytracker.com/id?1015570
https://exchange.xforce.ibmcloud.com/vulnerabilities/24437
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1625
http://www.mozilla.org/security/announce/2006/mfsa2006-08.html