mousemove, mouseover, and mouseout events are dispatched with high frequency, and can cause major performance problems, especially when their handlers are expensive. When used judiciously for specific elements, they're relatively performant, but I've come across two add-ons using them with delegation on entire documents, which is not.
Can you provide a heuristic for detecting abuse of these?
A substring match would be fine. You're not likely to find those strings anywhere but an event listener. Add to the above list mouseenter and mouseleave, which are worse than mouseover and mouseout.
We want to look for mousemove, mouseover, and mouseout in add-on code.