For [2], a natural place to start looking for bugs would probably be HbbTv; most modern smart TVs accept an extra MPEG elementary stream with a URL that they go download and display as an overlay through some extra magic (so yes, anything you change channels, your TV tells the channel provider you just did that). This means you can run arbitrary JavaScript code in a probably-not-very-well-hardened browser directly on the TV.

/* Steinar */