[kermit2]

Problem solved (sort of):

        // we want all subdomains, take everything after the first .
        if (substr_count($_SERVER['HTTP_HOST'], '.') > 1)
        {
                $vbulletin->options['cookiedomain'] = substr($_SERVER['HTTP_HOST'], intval(strpos($_SERVER['HTTP_HOST'], '.')));
        }
        else
        {
                $vbulletin->options['cookiedomain'] = $_SERVER['HTTP_HOST'];
        }

(the init_startup hook). This assumes your domain name only has one period in it, but if you have something like example.co.uk, the cookie ends up getting set for .co.uk (which obviously isn't a good idea, since anyone else on a .co.uk would be able to read it).

The second problem I didn't fully figure out, but it seems that if you check the 'remember me' box, IE 8 happily keeps you logged in to the main domain, so for the moment I've just edited my templates so that this is checked by default