The chances of them jumping are extremely unlikely and I don't think its ever happened or been documented. Data on separate partitions should be safe - Let alone on different operating systems. If you don't use XP for anything dodgy, and your smart enough not to open e-mails with viruses, then there is generally no need for virus protection... As far as I'm aware.
But if you download illegal software, music, or videos & visit disreputable sites then you should invest in good protection.
[disclaimer]I am in no way an informed person or an expert on the subject.[/disclaimer]
Though this is commonly where items are found, even "reputable" sites CAN transmit diseases.
Case and point, MMORPG.com which is a reputable site and does not contain anything 'dodgy' was the target of an attack. Someone, somehow got a banner uploaded either via hacking the site (which is what they reported) or by other means and that banner was able to infect hundreds if not more users that visited the site. Probably half of those users had the above mentality, others probably just didn't have any spyware/etc tool running to catch the trojan and others that did have it were alerted and MMORPG.com shutdown to cleanse. The users that weren't aware they were infected ended up having their video game accounts hacked as the trojan that was transmitted was a keylogger.
Now this is just ONE example of a normal non-warez site being the carrier of a trojan/spyware/whatever. Granted the users that visit that site were the target audience for the particular trojan the mentality of "I don't download pr0n or warez so I'm fine" is just stupid and careless.
True, your probably safe 90% of the time, but without a condom eventually you'll catch something even from someone who 'claims' to be a virgin.
When running Windows on ANY platform you should have some sort of protection regardless. Spyware/Adaware are good tools. You may not get an 'active' item, but you may end up a carrier to infect other people.
I doubt a 'keylogger' running in a virtual window, once the virtual window does not have focus, will be able to pick up keystrokes in the host, but if you have any of your Mac folders mapped as drives they can at least be 'read' by a program without your permission.
I once wrote a proof of concept for our security team where I executed a program that would go out on our network, look for all network shares (especially C$/D$ admin shares) and map them, index them, save the contents to a text file and post that contents to a web site. It caused our network team to re-evaluate our security. This is what can happen if you share any drives or map (reconnect at logon type drives) any drives from your Mac partition. We even went to class on how to 'hack' websites and how easy it was to do to upload a file, replace a file/banner, deface an html page, and sql inject to pull CC numbers and personal info.
If it was that easy, hackers are even better at it and can easily attack a 'reputable site' and replace a banner with a malicious one, as with the MMORPG.com example.
Be careful and remember to always carry protection in the windows world.
(damn caught me monologing)
