When a user types a new URL for the browser to load, the currently active page may detect when the new page is about to load and prevent the navigation, while still leaving the new URL displayed in the address bar. This can then be used to spoof the URL of the target page. The malicious page would need to employ social engineering tactics in order to guess what page the user is likely to try to load next, as it cannot see what URL the user has typed.
Opera Software has released Opera 12 and Opera 11.65, where this issue has been fixed.
Thanks to Code Audit Labs of vulnhunt.com for reporting this issue to Opera Software.