Microsoft also used p-code (http://en.wikipedia.org/wiki/Microsoft_P-Code) to reduce the code footprint in order to fit more of the big applications in the RAM which was limited then.
When we're still at Microsoft: http://en.wikipedia.org/wiki/Windows_Metafile_vulnerability "the underlying architecture of such files is from a previous era, and includes features which allow actual code to be executed whenever a WMF file opens. The original purpose of this was mainly to handle the cancellation of print jobs during spooling"
Yes, regarding P-Code, the funny thing is that Wirth originally planned to use it as a means to botstrap the compiler which would then be used to compile one that could generate native code, not as final execution medium. :)
- OS/400 user space is also bytecode based, JIT compiled on first run or installation time.
- Inferno userspace applications coded in Lingo
- Native Oberon has implementations with the kernel modules were AOT and the remaining modules are JITed on load
- Lillith (Modula-2 workstation)