This is the main reason I also use NoScript. Just today I saw two very tech savvy friends get caught out by a Facebook clickjacking attack. With javascript off on untrusted domains, it didn't work for me.
Wasn't there a recent study that concluded that Flash was the source of over 90% of all vulnerabilities last year?
I'm not sure, but NoScript also blocks Flash for me, so the outcome is the same.
Sure, but Flash is also straightforward to disable. It's not even installed by default in most browsers.
Flash and Acrobat were in the top 5, but I don't think Flash can take credit for a full 90%.