The kids miserably failed, nevertheless RSnake did not like it a bit.
Their payload was playful rather than venomous in my opinion, but you can judge by yourself:
0wning RSnake For Fun and PageRank
At any rate, from my NoScript standpoint, nice setter+name bypass combo — just you send me a mail next time, thanks ;)
Latest release already defeats it, but for those who disabled automatic updates, it’s time to get it…