We insert HTML from HTML emails into the conversation viewer.  If this contains positioned HTML elements, they could escape from the div.body of the email.  I've never seen this happen, and I suspect few emails actually try to use positioning in the first place.  Nonetheless, this is a potential attack vector -- you could try to position elements over top of our chrome, to some nefarious end.

I see two variants of this.  The first is with absolute positioning, which works relative to the nearest positioned container.  Right now, that's the body element, but we can make div.body positioned easily enough.  (See attached patch.)  Existing overflow statements prevent negative values from making elements visible outside of the div.body.

The second is using fixed positioning, which works relative to the viewport.  As far as I know, you can't trap fixed positioning inside anything other than an iframe.  I have trouble believing this would be used in normal emails, but it would be convenient for attackers.