The section on maxlength in http://www.whatwg.org/specs/web-forms/current-work/ (the 12 October 2006 version) says nothing about what happens if script on the page (or script from a bookmarklet, whatever) does:
myInput.value = "some long string"; where the string length is longer than myInput.maxlength. This should probably be specified. See also https://bugzilla.mozilla.org/show_bug.cgi?id=345267 -Boris