Not withstanding exploits, the user still has to accept the offered link, so it's not really stealthy in that case.