Browser holes like that are extremely common and people do get viruses from javascript. If you follow the security community, you will frequently see alerts warning of a new piece of malware that is ...