The two pictures, and most of the events I have been describing, occurred in Camino browser, not Safari. I have seen some of this once in Safari, but it never went to any page other than PT. It only failed to complete loading a page on the PT Web site, and showed the suspicious URL in the address bar.

The only extensions I have in Safari are

DivX HiQ
DivX Plus Web Player etc.
Ghostery (added today)

I do not think Camino provides for extensions.