Fotiman - 2:22 pm on Mar 15, 2012 (gmt 0)

This is to allow page anchors to function within Firefox

Huh? I don't know what you mean by this. Page anchors work just fine in Firefox.

$(document).ready(function(){ $(window.location.hash).append('<a name="' + window.location.hash.replace('#','')+ '"></a>'); window.location.href=window.location.href; });

This bit of script can be dangerous, though not in the way you're thinking.
Here's what it's doing:
When the document is ready (just before onload), it will execute a function which gets window.location.hash (a string containing the hash value, if there is one, or an empty string... for example, if you were viewing "http://example.com/index.html#foo" this would get the string "#foo"). It wraps that in a jQuery object using $(window.location.hash), and since ID selectors in jQuery use this same format, it creates a jQuery object representing the element on the page with that ID. It then appends to that element a page anchor with a name that matches the id. For example, if your page had this:

<div id="foo"> Some content ... More content </div>

Then you would end up with this in the DOM:

<div id="foo"> Some content ... More content <a name="foo"></a> </div>

Notice, the anchor is inserted at the END of the content (that's what append does).

Next comes the piece that doesn't make any sense:

window.location.href=window.location.href;

This will cause the page to reload the current location if there was no hash value. And since this script is included on every page, you can end up in an endless loop of page reloads, and you'll probably need to kill the browser process to get out of it.

I don't really understand what the purpose of this script is, since browsers will correctly jump to elements with a matching id value as the hash. Are you trying to get the browser to jump to the END of the element?

Also, I don't know what you mean about the lines showing on the active html page or requiring CSS file placement.

Do they present a vulnerability to the server? Only a potential Denial of Service attack in the event that a URL with no hash value is entered.
Hijacking of links? Nope.