In situations where a vendor has a kiosk using the Mozilla browser, it would be nice to be able to disable JS features which change the state of the mozilla window. For example, it would be nice to disable open() so that "consoles" and console-based ads would not work as they generally tend to annoy/confuse/etc users, especially in situations where the user is not expected to be savvy. Disabling JavaScript is an acceptable workaround for the time being, however more granularity would be a wonderful addition.

Security issue? Or maybe DOM, but they got the last one.

Check out http://www.mozilla.org/projects/security/components/configPolicy.html. You can disable window.open() as the default if you choose with a little editing of the preferences file. We may make this feature accessible through the preferences UI if we get the time, so the format may change, but the core functionality is present.

Verified worksforme.

[RFE] is deprecated in favor of severity: enhancement. They have the same meaning.