Secure site lock can be spoofed with view-source: — Mozilla

Kohei Yoshino reports the secure site lock icon can be spoofed by using a view-source: URL targetted at the secure site whose credentials you want to appropriate. An insecure page of the attackers choice can then be loaded while the lock icon shows the previous secure state.