Indeed, font parsing has been a focal point for browser security for awhile too; Chris and John (both of whom worked at Matasano, #shameless) have been hunting for bugs in them for years. It's good of Yahoo to pay them to do it publicly like this.