These are more issues with how Javascript is handled on the web. I'd imagine that js sanitizers have gotten more sophisticated so the callback (first) example may be a bit weak; if you're accepting code from an unknown source, even if you're filtering it first, you're gonna have a bad time.

Opera using Chromium (v8) rather then Carakan. And these aren't really security holes so much as Javascript quirks that you should watch out for.

I doubt. I would like to go through the release notes.