This is a demonstration for IE6.0 where you can overwrite content on another target by poping up the side navigation. You are bound by the width of the search box, but that feels pretty exploitable. I just haven't done nearly enough testing on this to validate that it works. Click the link below to start the process (requires that JavaScript is enabled). Again, this only works on Internet Explorer. Http-equiv and I messed around with this quite a while back, but nothing ever came of it because SP2 was just released. It still feels exploitable to me though.

There's the death star