Because we filter out javascript: URIs unless the user types in "javascript:", keyworded javascript bookmarks won't show up. But typing "javascript:" can changes the desired keyword if it's a javascript URI using %s. Jesse: Any suggestions on if we should just let keyworded bookmarks not do the javascript: check? I'm not sure if it's possible.. but potentially a text box could be in a form whose action is a javascript URI, so a user could "create keyworded bookmark for this search". A javascript uri that can process whatever the user happens to type in for %s could potentially be dangerous.. ?

That's only an issue if a user actually right-clicks on a textbox on a malicious site, selects "Add keyword for search", fills in a keyword, and then uses that keyword... right? We should probably prevent "Add keyword for search" from using data: or javascript: URLs, but it's not a big deal.

To add to this discussion, javascript bookmarks with/without tags also can't be accessed through the autocomplete via the location bar unless "javascript:" is entered into the field. I've seen this on the latest 3.1b3 release build on all platforms: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1b3) Gecko/20090305 Firefox/3.1b3