Vulnerabiility in Firefox 1.0,3 and 1.0,4

Read all about it at MozillaZine Talkback

You can close the hole (until 1.0.5 is released) by clicking Tools, Options, Advanced, Tabbed Browsing and changing "open links in a new window" to "open links in a new tab in the most recent window":

Simple fix for a simple fox.