I've been wondering lately if RC4 is so flawed in all its forms, why is it that it is still being supported by all major browsers per default? Why does the typical chrome browser prefer ECDHE-ECDSA-RC4128-SHA over ECDHE-ECDSA-AES128-SHA?
RC4 has known biases, which have been measured with great accuracy. Exploiting these biases into an actual attack requires observation of many (millions) of successive connections where some specific secret data (say, a given password) always appears at the same place. Such a scenario can be forced in lab conditions but barely applies to practical, real-life situations. This is why it is usually considered "not urgent" to obsolete RC4.
Some SSL clients prefer RC4 over AES because of all the bad press about the BEAST attack (despite the fact that the same clients are not actually vulnerable to BEAST).