Samy posted a piece of very cleverly crafted stuff on his profile in MySpace, which basically made everyone who saw his profile add the same code to their profile, and add Samy to their friendslist together with some text. This shows the fragility of browsers when using AJAX to code sites, despite some fairly complicated filtering at MySpace, which Samy managed to get around.

The technical explanation and code itself is here

There’s an interview with samy and some more (easier) explanation here