You know how when you post a comment, there's that red message that says "The comment has been posted. It may not immediately appear on this page due to caching, please be patient."

Did you ever notice that it says that up in the address bar? It looks something like this:
http://blogs.starwars.com/jawajoey/125/comments?message=The%20comment%20has%20been%20posted.%20It%20may%20not%20immediately%20appear%20on%20this%20page%20due%20to%20caching,%20please%20be%20patient.

Did you know that you can change that manually, to say other stuff?
http://blogs.starwars.com/jawajoey/125/comments?message=Wait,%20seriously?%20No%20way!%20

But wait, there's more! You can actually post html into that string and it will work. (You can type stuff in normally. It'll convert spaces to %20 for you, and it's just because of posting this link that the %3C and %3E are necessary for the brackets.
http://blogs.starwars.com/jawajoey/125/comments?message=HTML?%20Surely%20you%20jest.%20If%20that%20were%20true,%20Id%20be%20able%20to%20do%20line%20breaks!%3Cbr%3E%20And%20Horizontal%20rules!%3Chr%3EAnd%20make%20tables!%3Ctable%20border=2%3E%3Ctr%3E%3Ctd%3EWith%20different%3C/td%3E%3Ctd%3E%3Cfont%20color=blue%3Ecolors%3C/font%3E%3C/td%3E%3C/tr%3E%3Ctr%3E%3Ctd%3E%3Cfont%20size=5%20color=green%3Eand%20sizes!%3C/font%3E%3C/td%3E%3C/tr%3E%3C/table%3E%3Cbr%3E%3Cmarquee%3E%3Cfont%20color=blue%3EBut%20surely%20I%20cant%20use%20silly%20things%20like%20Marquee.%3C/marquee%3E%3Cimg%20src=http://images3.wikia.nocookie.net/starwars/images/b/bb/Taejitsu.jpg%3E%3Cbr%3E%3Ca%20href=http://www.youtube.com/watch?v=5blbv4WFriM%3EImages%20and%20links,%20too?%3C/a%3E

(Frames and embeded youtube videos don't work, however)

Yikes! I don't even know what other kind of things you could put in there, or if anything sinister could actually pose a security risk to the site, but I think this is something StarWars.com should be aware of. It makes for a pretty conspicuous URL, though, so it's not the worst issue ever.