"that means you can "keep" the user on a site. when you type a new url in the address-bar, javascript overwrites it." Annoying, but not very dangerous. When I type a new url, I get brought to a "file://localhost/[...]/unload.html". Then I type a new url, and that's ok. I wouldn't disable javascript for that.