[xorcist]

It's not just theoretical. If you want to infect users of well known web sites, buy ads on them. The major ad networks all say that they check for that but in reality they are very lax about what they run.