Use Chrome (PDF reader built in) and turn on Click-To-Play for all plugins (e.g. Flash, Java) then add YouTube to your white-list.

Settings->Show Advanced Settings->Content Settings->Plug-Ins->Click to play

Then:

Settings->Show Advanced Settings->Content Settings->Plug-Ins->Manage Exceptions->[*.]youtube.com->Allow->Ok

You're now fairly safe from MOST drive-by attacks. Except those that impact Chrome directly.