it appears that Apple's Safari is vulnerable to the old Mozilla/IE cookie theft vulnerability outlined by Marc Slemko http://alive.znep.com/~marcs/security/mozillacookie/
This seems to even work if cookies are disabled. Stupid, really!