Tests are typically done by finding a known malicious site and browsing to it while in a sandboxed environment. NSS labs used that technique for its recent tests this year, testing IE, Chrome, and Firefox. One of the sources of malicious URLs that NSS used was MalwareDomainList.com, which might serve as a something you could use in the same way, as long as you protect yourself.
I'm not sure how a fake malicious site would provide value, a la EICAR. I use EICAR to test AV avoidance and unique protection configurations, but the file is under your control and is readable. In that case, using Metasploit or SET might be a better way to test for browser protection because it is under your control and you know what it is doing, although you won't be able to test reputation services in the same way.