Nice try, but no, that's a broken old trick. window.status is gone for exactly this reason, but things like onclick="this.href=http://evilsite.example/" (or even onclick="window.location=http://somewhereelse.evil.example/;return false") still work (link shows a benign location, but it's changed to a malicious one when you click).
The href attribute is still changed. While javascript can't change the status bar explicitly any more, they can set the link's href to the fake URL and change the link's target in the click event.
I use A without href only when I'm making an actual anchor A name. When I use href=#, I always have javascript onclick return false. This won't stop crawlers but it keeps the user's history and address bar clean.
reply