The two trojans discovered this month for Bluetooth and iChat have been non-events, but the Safari vulnerability is a major security flaw. I've discovered that any app archived by itself in a .zip file is automatically launched if Safari is set to open safe files. See several examples of the vulnerability in action.