Depends on the browser, but in Firefox and Chrome you can certainly pop a window using a click event. Assuming a JS library was clever enough to simulate the OS-chrome believably it could be easy enough to trick people.