I was investigating a problem with lightbox popping up PDF files on mouseover, as opposed to clicking as required by images. I found the problem in modules/lightbox/js/clsource_music.js line 837. I then found it had been fixed in SVN 6703, however, the fix is IMO inadequate.
The problem is parsing comma-separated arguments and handling extra whitespace around the comma. The SVN 6703 "fix" changes split(",") to split(", "), but that is not a robust solution. The fix should be split(/\s*,\s*/) so that any amount of whitespace is handled.
Similar changes should be made elsewhere too, eg line 830, 859, 880, and 973.