I use VMs all the time. I also use Sandboxie. It is quite eye-opening how often a Web browser gets compromised and sandboxIE starts popping up warning messages about the browser trying to access services that it should never try using. With sandboxie, the damage is limited, and I can dump the Web browser, erase everything it has mucked up (all changes are redirected to the sandbox directory), and restart. If things get really hairy, I can dump the entire virtual machine to a known clean snapshot. As an added bonus, the virtual machine is locked behind a layer of network address translation, so it can't find other boxes to hack if it does get nailed.
I think I may just pony up for a Mac sooner or later. Since I rarely change desktops (my last machine lasted a decade until the USB controller went south), might as well get something decent, and with VMWare Fusion, I can run my Web stuff isolated from everything else.