I wrote three extensions for kiosks during my 2004 summer internship at IBM:
Lets you control which sites the browser will connect to by editing a file called "allowed-sites.txt" in your profile directory. You can create a whitelist, blacklist, or more complicated set of rules. You can specify rules using regular expressions, URL prefixes, or exact URLs.
I created a list of common kiosk features. If you're creating a kiosk, you should at least skim this list to make sure you didn't miss a security feature you'll need.
I've also gathered some thoughts on cookie expiration for kiosks.
Help with these extensions: Jesse Ruderman, Doron Rosenberg (IBM).
Help making kiosks in general: Mozillazine extensions forum, Kiosk mailing list, Mike Kaply (IBM).