I wrote three extensions for kiosks during my 2004 summer internship at IBM:
Lets you control which sites the browser will connect to by editing a file called "allowed-sites.txt" in your profile directory. You can create a whitelist, blacklist, or more complicated set of rules. You can specify rules using regular expressions, URL prefixes, or exact URLs.
When a user stops using the browser for a specified period, resets the browser and clears all user information. Use about:config or prefs.js to set extensions.kioskreset.inactivity.seconds to the desired value. Does not reset clipboard, prefs, home page, JavaScript console. Also adds a "Done" (reset) button to the toolbar. This button does not have an icon, so you have to switch to text-and-icons mode to see the button.
I created a list of common kiosk features. If you're creating a kiosk, you should at least skim this list to make sure you didn't miss a security feature you'll need.
I've also gathered some thoughts on cookie expiration for kiosks.
Help with these extensions: Jesse Ruderman, Doron Rosenberg (IBM).
Help making kiosks in general: Mozillazine extensions forum, Kiosk mailing list, Mike Kaply (IBM).