This is a completely safe link to the login page for Dropbox. (Use a regular click, not middle or 'Open in new tab')

The above Phishing demo relies on two simple Javascript methods:

1. "event.preventDefault()" on this page, the link above is actually a real link EXCEPT for some attached Javascript that stops the URL redirection and then directs the browser to my fake page at http://dl.dropbox.com/u/156162926/login.html (I was inspired to do this by the fullscreen exploit demo at feross.org)
2. "window.history.pushState()" on my fake page, which simply changes the address in the URL bar without reloading. It's a relatively new HTML5 feature, and will probably only work on up to date versions of Firefox, Chrome et al.

Granted, you can't use it to change the domain part of the address, but it's not an issue if you've found a way to run Javascript on the target's domain to begin with. While as far as I know you can't run Javascript directly on dropbox.com, the subdomain barely looks any different, and I suspect there'd be other services just as vunerable if not more vulnerable.

Am I being overly dramatic about this or should this be a real concern?