You can't have both HTML and XHTML, it's either one or the other. This sort of thing has been explored extensively at
http://www.cssplay.co.uk, have a look at his tabbed photo galleries. The (big) disadvantage is that if the user clicks outside the tab, it disappears back to the default one. This is where javascript is useful because CSS doesn't provide a "clicked" pseudo-class, only "active" and "focus", which are not the same and not wholly supported across all the main browsers.
A better idea is to make all three tabs (or however many you have) one after the other, so that with JS off the user can still use all of them. Then with javascript you create the tabs and make your "widget". This is what is called progressive enhancement. In the other direction, you could then say that your page will "degrade gracefully" when JS is off.
Javascript isn't a flaw. And in this instance there is no security issue really, all you're doing is adding/removing class names from HTML elements.
Bookmarks