What about javascript: URLs? Right now, every browser seems to treat javascript:alert('#') in an "intuitive" manner. This likely goes beyond data: and javascript:, so I think it would be useful to look at it more holistically. /mz