Nice try, but no, that's a broken old trick. window.status is gone for exactly this reason, but things like onclick="this.href=http://evilsite.example/" http://

Nice try, but no, that's a broken old trick. window.status is gone for exactly this reason, but things like onclick="this.href=http://evilsite.example/" http://evilsite.example/" (or even onclick="window.location=http://somewhereelse.evil.example/;return http://somewhereelse.evil.example/;return false") still work (link shows a benign location, but it's changed to a malicious one when you click).