Overview:

Safari on occasions may improperly parse the source of an HTML  
document, which can lead to the execution of html tags within  
comments. This can become dangerous when input filters allow html  
tags within comments, as they will get parsed and executed under  
certain circumstances.

Details:

In some cases you can cause Apple=92s Safari browser to execute code  
when it should not be executed. In the following example everything  
within the comment, in theory should never be executed; however,  
safari decides to execute the script tag.