The fake URL in a JavaScript comment in the the JavaScript URI is a hilarious and neat trick.

    javascript://bishopfox.com/research?%0d%0aalert(1)

gets interpreted as:

    //bishopfox.com/research?
    alert(1)

Fortunately most browsers prevent you from pasting JavaScript URIs in the URL bar these days.

It's a little surprising Apple overlooked not one but two fairly obvious major holes: allowing JavaScript URIs, and the lack of same-origin policy. I wonder how many other applications are similarly vulnerable.