The Zone doesn't have the particular vulnerability you brought up originally. I can show you the generic "bookmarklet" technique for script injection, though.

Suppose you want to inject this line of JS on to a page:

alert( "doh!" );

Format the code like this:

javascript:(function(){alert%28%20%22doh%21%22%20%29%3B})()</t>

Paste it into a browser's address box, and voila, "doh!".

The key is the "javascript:" protocol--like "http:" it tells the browser how to make a connection. In this case, it tells the browser to run the JS and, if it returns HTML, display it; if not, just run it. The original idea was to let people generate HTML using script; a more conventional usage went something like:

javascript:parent.FrameHTML()

function FrameHTML()
{
return "<html><body><p>generated page</p></body></html>";
}

That's a fantastically useful feature, and a lot of people have used it, so it's not going away, even if it does create a security hole. That's because the script executes in the page environment (note the use of "parent." above--parent relative to the IFRAME), and there seem to be no security restrictions on it. Suppose you want to read the contents of a password field. The straightforward code is one line of JS:

alert( document.forms["login"].elements.Password.value);

Which looks like this formatted as a bookmarklet:

javascript:(function(){alert%28%20document.forms%5B%22login%22%5D.elements.Password.value%29%3B})()

Of course, as a practical matter, you have to have be in a position to get the bookmarklet "URL" into a browser. If you have physical access you just inject it through the address box, but it also works in a link. Displaying info in an alert box only edifies the user, but more elaborate code could possibly construct a form and submit the data somewhere.

As always, I enjoin you to use your newfound powers wisely and only in the service of humanity....