"Spyjax exploits a simple feature of all browsers: changing the color of links for sites you’ve visited. A piece of javascript on a webpage can view the color of these links to determine whether you’ve visited a site. This can’t just extract your entire browsing history, since it needs a predefined set of URLs to test - thanks to ajax, however, thousands, even tens of thousands of URLs can be tested in a matter of seconds."

Bloody sneaky trick. Never thought of using JS that way, but it definitely works, and many may argue needs to for scripting purposes and flexibility.