Yet another usability attack: GIF+JAR

"A photo that can steal your Facebook account"
http://www.computerworld.com/action/article.do?command=viewArticleBasic&
articleId=9111298
... Here's how an attack would work: A bad guy would create a profile on
a popular Web site -- Facebook, for example -- and upload his GIFAR
(GIF+JAR) as an image on the site. Then he'd trick a victim into
visiting a malicious Web site, which would tell the victim's browser to
go open the GIFAR. At that point, the applet would run in the browser,
providing the hacker access to the victim's Facebook account.