Meanwhile, a year later.

Updated the test html to 'cover' all skins (mostly increasing dimensions and offset).

!!! If testing on production wiki, please *DO NOT SAVE* but use preview we don't want to hand the below hack on a plate for someone to abuse

Location: http://mw.local.dev/wiki/Sandbox?action=edit
Content:

<div style="
 position: absolute;
 top: -180px; left: -10%;
 z-index: 99999;
 width: 120%; height: 270px;
 background: rgba(0, 255, 255, 0.8);
 outline: 1px solid red;
 font-size: 2em;
 text-align: center;
">
<div style="
 position: absolute;
 top: 0; right: 0; bottom: 0; left: 0;
 overflow: hidden;
 background: rgba(255, 255, 255, 0.8);
 outline: 1px solid blue;
">
[[File:Transparent.gif|4000x4000px|link=//example.org|Click]]
</div>
Navigation/Search overlay
</div>

<div style="
 position: absolute;
 top: -170px; left: -190px;
 z-index: 99999;
 width: 170px; height: 340px;
 background: rgba(0, 255, 255, 0.8);
 outline: 1px solid red;
 font-size: 2em;
 text-align: center;
">
Logo overlay
<div style="
 position: absolute;
 top: 0; right: 0; bottom: 0; left: 0;
 overflow: hidden;
 background: rgba(255, 255, 255, 0.8);
 outline: 1px solid blue;
">
[[File:Transparent.gif|350x350px|link=//example.org|Click]]
</div>
</div>


Current mediawiki/core.git@master:

== Vector skin ==
- Logo:       Not safe
- Sidebar:    Not safe
- Personal:   Safe
- Tab bar:    Not safe
- Sitenotice: Not safe
- Page name:  Not safe

== Monobook skin ==
- Logo:       Safe
- Sidebar:    Not safe
- Personal:   Safe
- Tab bar:    Not safe
- Sitenotice: Not safe
- Page name:  Not safe

There are weird z-index overrides all over the place. For example the following have an overriden z-index that made them safe for this test:

- li a.selected (the selected tab in the tabs)
- #p-search (portlet for search in the sidebar)
- #p-logo (portlet for the logo in the sidebar)
- #p-lang (porlet for interwiki links in the sidebar)

But the other tabs or the tab bar itself, and the other portlets or the sidebar itself are all not safe.

== Modern skin ==
- Logo:       Not safe
- Sidebar:    Not safe
- Personal:   Not safe
- Tabs:       Not safe
- Search:     Not safe
- Sitenotice: Not safe
- Page name:  Not safe



Working on a revised patch set now based on a more solid approach.