Firebug is your friend. It allows you to see all of the calls that are being made, how long they take, and other great information.
That means it can steal your cookies, make requests on your behalf (but not login) and generally misbehave. When the browser or webpage closes, the XSS ends and no more badness happens on your machine.
The key feature here is that even if you are attacked via an XSS in a site that you use, the attacker doesn't get to run malware on your system, and doesn't get to look at the documents on your machine or install malicious programs on your desktop.
It's also worth pointing out that a number of more modern browsers have mitigations in place to reduce the effect of some types of XSS vulnerability. Make sure that you are using at least IE9 or a recent version of Firefox, Chrome or Opera to make sure that you are fully protected.