I think there have been cases in the past, but that hardly matters. When you visit a site you run the risk that it has been exploited to spread malware. Would you want to also run the risk that one (or more likely a dozen) other sites running code on that page have been exploited as well?