A few things:
1) yui-gen# is an automated ID given by the Yahoo API to anything with event listeners. It will not always reference what you are trying to get, since the # is semi-random and based on the order event listeners are executed. Use an identifier that isn't YUI-based.
2) the first parameter of drawImage is supposed to be an element?
3) Is your first code running from your domain, or is it running from inside a userscript? A script added from your domain to the userscript does not count as running from the userscript. Running it entirely within the userscript should remove the security error. And like I said, if you are insistent on running it from your domain, I can put just the secured code into the LGaia object, and then you could interact with the secured content through LGaia.
4) Try using an absolute path for image.src = "/path/to/tot_month.png" instead of using the dot directory navigators.
5) Why does the second script say "undefined" even though data seems to hold a value?