Umm... malicious code, popups and browser crashes/attacks are still common, and still rely on Javascript. It has become much less convenient to disable it, but...
Crashes are now mostly the domain of Flash, though. JS hangs in an infinite loop sometimes, but that's not a crash. Actual JS-originated crashes are exceedingly rare in my experience, and are usually the mark of an experimental-build browser.
Popups are largely handled by every major browser having popup blocking that works reliably enough.
Malicious code is what the ad-supported internet runs on. The only thing they can hit is your already-public data - the use of that data is the only thing that can be construed as malicious.
