Problem with DNS servers allow phishing attacks...

[iago]

There are a lot of problems with IE and Outlook that let you show one thing in the status bar/address bar and a different site, but here's a fairly cross platform method. 

Use the url, "http://www.anysiteyouwant.com+www.evilsite.com".  For example, I'm making up an ip here:
http://www.citibank.com+207.161.152.16.  That will take the user to 207.161.152.16. 

This isn't a browser problem, however, this is a DNS problem.  Here is an example, using a DNS name:

iago@slayer:~$ host "www.seclists.org"
www.seclists.org has address 205.217.153.59
iago@slayer:~$ host "any-site-here.com+www.seclists.org"
any-site-here.com+www.seclists.org has address 205.217.153.59

One interesting thing to note, however, is that this doesn't work in FireFox. 

[deadly7]

Haha, where'd you find this out? Neat.

[iago]

On a mailing list.