- It's not an issue in IE9: "The prefix JavaScript: is stripped from any text pasted into the IE9 address bar. This mitigates a socially-engineered XSS attack common on social networks wherein users were tricked into performing self-inflicted XSS injections upon themselves. No, CTRL+C,ALT+D,CTRL+V, ENTER will not give you magical powers" (http://blogs.msdn.com/b/ieinternals/archive/2011/02/11/ie9-r...)

- Found the following issue for Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=305692

- Found the following issue for Chrome: http://code.google.com/p/chromium/issues/detail?id=6888