Common Vulnerabilities and Exposures assigned an identifier CVE-2008-2000 to the following vulnerability: Unspecified vulnerability in Apple Safari 3.1.1 allows remote attackers to cause a denial of service (application crash) via JavaScript code that calls document.write in an infinite loop. Refences: http://www.securityfocus.com/archive/1/archive/1/491192/100/0/threaded http://es.geocities.com/jplopezy/pruebasafari3.html http://www.frsirt.com/english/advisories/2008/1347 http://xforce.iss.net/xforce/xfdb/41985
This seems to be WebKit issue, not specific to Safari. Malicious JavaScript can cause huge memory and CPU resources consumption, leading to a browser crash. We do not treat this kind of client application crashes as security issues, so I'm closing this as notabug. If this get addressed upstream (e.g. by implementing some check that will allow user to interrupt JavaScript execution after some time, same as gecko does), we'll follow shortly.