http://uk.youtube.com/watch?v=QJhcGRJEQ2w, for starters - it's the WebKit carpetbomb bug (that's been fixed in WebKit for
ages).
On the other hand the worst it can do, unless you've disabled UAC or blindly hit Continue/Allow, is mess up your own stuff - but that's the worst that can happen with "insecure" Firefox/Opera/IE without protected mode.