Or display any compressed image, or even download compressed javascript that you aren't going to run. A number of exploits that malwaredomains.com finds are objects that are either normally or optionally compressed, and constructed in such a way to exploit an issue with the decompression software used.
If I'm both curious and suspicious (so in my most tin-hatish of moods) I fire up a virtualbox instance with a clean image, look at the site, and then delete that virtual machine image. That seems to also have an unintended prophylactic effect since virus investigators like to run viruses in VMs so malicious payloads don't fire if they detect they are running in a VM (at least according to the F-secure blog).
But either way, my point was that just visiting a site that wants to get you is a risk, whether or not you think you are protected.
