Cory Doctorow had an essay that speaks to this point recently: http://www.locusmag.com/Perspectives/2010/05/cory-doctorow-persistence-pays-parasites/

TL;DR: Even if you're clueful and security-conscious most of the time, all it takes is one momentary mistake, and nobody can be perfect. Phishers and scam artists know this, and attack constantly and without cease, so that even though they fail 99.9999% of the time, those few successes yield great returns.

This article argues almost entirely by assertion. What little isn't merely unsupported opinion is hearsay.

Except that it isn't. According the GnomeShell page on Gnome Live, "Much of the code of the shell is written in Javascript and Clutter and GNOME platform libraries via GObject Introspection and JavaScript bindings for GNOME."

GObject Introspection is actually quite cool IMO, it makes it much easier to create bindings from dynamic languages libraries that use GObject, like the GNOME platform, GStreamer, etc.

I just tried it against nginx 0.6.37. The attack appears to work there as well.