Actually there are some CSS vulnerabilities that works without JavaScript like <div> overlay affecting phishing attacks: http://i8jesus.com/?p=10

Via: http://stackoverflow.com/questions/718611/css-injection-what...