Any user can embed JavaScript into there yahoo profiles. When the user selects to change his picture then selects point to a photo on the Web. They can then embed javascript on the end of the url. An example of this can be viewed here http://uk.profiles.yahoo.com/embeddedjs This has been active for a while now and yahoo have still took no action in fixing it.
