Security researcher Didier Stevens ran a google ad that promised to infect the pcs of anyone who clicked on the ad.

More importantly, the ad ran unnoticed by google for about 6 months and 409 people clicked on this during this time period!!

more here.

http://blog.wired.com/underwire/2007/05/hundreds_click_.html