Dragging Javascript URLs to the address bar could cause them to be loaded, bypassing restrictions and security protections
If an insecure element was added to a page after a delay, Firefox would not replace the secure icon with a mixed content security status
Vulmon