view the source. script called from a css background url can open a popup, email message url("mailto:address"), pretty much anything.