I thought we had made a standardized VM language called Javascript so we could forget this whole activeX thing ever happened..?

Not that I disagree that a VM would be very awesome, but it should take as many clues from the collected knowledge of Javascript security as possible, obviously just hooking your 'sandboxed' VM to the browser doesn't cut it. As demonstrated by SUN's Java applet :)