This really depends on the sites you're logged in to and how alert you are as a person. I can imagine the following scenarios (not specific to any of the sites you mentioned, but just general scenarios):
Sensitive information is transmitted in the URL: For each request, a session ID is transmitted in the URL. In this case proxy servers will log the session ID and anyone access to these log files is able to perform session hijacking. This information could also be stored in your local cache, anyone having physical access to your machine might use it.
Cross Site Request Forgery: Missing or poor implementations of anti CSRF tokens could lead to un-validated actions on your behalf because the origin of the request is not validated. An example of a poor implementation of anti CSRF is transmitting these tokens in the URL (see #1.)
Cross Site Scripting & Insufficient cookie settings: If a website does not properly secure its cookies (e.g. missing the HTTPOnly attribute) and an XSS vulnerability exist in the same website, your session ID might get stolen while visiting a malicious site (e.g. cookie stealer).
HTTP Resonse Splitting: Also known as CRLF injection (%0A%0D) is a vulnerability due to the lack of input validation. It may lead to poisoning of the client’s web-cache, cross site scripting, theft of sensitive information and other.
Does this apply to the sites you mentioned? Unfortunately yes, it does! Although most of these sites are known to be secure, every once in a while certain vulnerabilities are discovered.
A question you should ask yourself is, should I always have an active session while browsing possible malicious websites?
Another question could be, why do I browse possible malicious websites with the same browser I use for the sites mentioned?
Your bonus question:
I would like to invalidate the "fully patched operating system". There are 0days out there that are not reported to the manufacturer(s) (that's why they're called 0days in the first place). There's no such thing as being 100% secure.
Your router: We've seen in the past that even though the router's remote administrative interface was not enabled, there was a backdoor in a specific router which could access the administrative interfaces with a specific User Agent (no credentials required).
Having said that, it doesn't mean you should get paranoid.