My first thought along these lines was "do I now need a NoCSS plugin along with NoScript"

at what point is CSS powerful enough to become a malware vector.