Mozilla 1.1 and earlier, and Mozilla-based browsers such as Netscape and Galeon, set the document referrer too quickly in certain situations when a new page is being loaded, which allows web pages to determine the next page that is being visited, including manually entered URLs, using the onunload handler.
http://www.redhat.com/support/errata/RHSA-2003-046.html
http://www.redhat.com/support/errata/RHSA-2002-192.html
http://www.mandrakesoft.com/security/advisories?name=MDKSA-2002:075
http://www.iss.net/security_center/static/10084.php