I didn't see this posted anywhere, but How to attack firefox code has been posted on the net. Firefox has a patch available, but Netscape which is based on firefox hasn't.