Some of the responses here claim that the "javascript:" prefix is a "leftover from the old days", implying that it's intentionally, specially handled by the browsers for backwards compatibility. Is there solid evidence that this is the case (has anyone checked source code)?
<span onclick="javascript:alert(42)">Test</span>
To me, this just reads as:
javascript:
alert(42);
Meaning, that "javascript:" is just a label and has no effect. This works, too:
<span onclick="foobar:alert(42)">Test</span>
Update:
I did a little experiment and it turns out that, yes, "javascript:" is handled specially by IE, but definitely not so by Firefox, Safari, Opera or Chrome:
<span onclick="javascript:while (true) { alert('once'); break javascript; }">Test</span>
On non-IE, this will just alert "once", once and then break out of the loop. On IE, I get a "Label not found" error. The following works fine in all browsers:
<span onclick="foo:while (true) { alert('once'); break foo; }">Test</span>
Update 2:
I just realized the link http://crisp.tweakblogs.net/blog/the-useless-javascript-pseudo-protocol.html in one of the answers above pretty much talks about the same thing.