Now that XSS exists, sometimes servers actively try to target their clients.

<ul>
<li>find out what sites they've visited:
        <a href="http://www.azarask.in/blog/post/socialhistoryjs/">"how does it work?"</a>
        <a href="http://www.mikeonads.com/2008/07/13/using-your-browser-url-history-estimate-gender/">[1]</a>
<li><a href="http://www.phpsolvent.com/wordpress/?cat=20">find out what Firefox extensions they have installed</a>
</ul>