This post follow along the same lines, however a bit more blackhat[1]. He also did another write up about using images to store xss data a while back. It is great if the image is loaded into javascript, other wise it will not work.

http://ha.ckers.org/blog/20070604/passing-malicious-php-thro...