Even behind a firewall, this isn't a good practice, especially if you are running Windows/IE.
I am behind a firewall. I have an outbound proxy server, and run anti-virus, anti-spyware, local firewall and registry cleaner on a regular basis. My work machine is linux and my home machine vista.
Then again, I’m in the computer security business and a tad paranoid. But I have never had a serious virus and only some minor spyware.
We do not surf the porn sites or any other questionable content sites. I am an electronic tech by trade and I do believe the anti virus software actually draws the bad junk to your computer.