[Zulithe]

It just happened to me too, in fact it was a mass PM done by account name: AvatarofWoe

using html script: <.HTML><.BODY onload=while(1)alert('@_@') > <./BODY>

Simple yes, but it can crash graal and even your whole PC because Graal doesn't have any kind of built in protection against this sort of thing.

The only real way to prevent it, for now, is to turn off HTML in your contact list options.