Iit's only the Facebook, Twitter and Digg attacks that don't work in MSIE and Opera. The GMail attacks works in all of them. The reason the "script" based attacks don't work in Opera and IE is because they don't fire the onload/onerror events if the returned content isn't valid JS.