[sockwater]

Right, except that's not really what we're talking about since there is no monetary gain in that.

The cookie stuffing we are talking about is for example: Say 
I have a Commission Junction account and am an affiliate 
for eBay.  For me to get paid, I have to send people to 
http://www.ebay.com?affiliateid=12345
When someone visits that URL, an ebay.com cookie is set on 
their machine.  Then if they sign up/ make a purchase etc 
within 60 days then I get a commission.  You can't set an 
ebay.com cookie from floris.vbulletin.com  You could have 
floris.vbulletin.com/stuff/vborgtest.jpg be a php script that 
redirects with a 301 redirect to ebay.com?affiliateid=12345
but then my Javascript would still catch that, since it's not 
a valid image. Cookie stuffing works because even though the 
image isn't valid and isn't displayed, the headers that are 
received get acted upon by the browser, setting a cookie.  
The only two ways of stuffing affiliate cookies is via an 
iframe or via an image that references the target affiliate 
site. These of course can be obfuscated using javascript 
tricks.  The only vulnerability for vBulletin is the [IMG] 
code, assuming that you don't have html turned on.