The best way to sandbox programs in OSX?

Solution 1:

easiest and most secure way

Please choose A or B, not both.

really malicious programs

Are we talking invasive virus software, like the stuff that came on Sony CDs?

Either a carefully-configured virtual machine, like VMware Fusion, or an isolated physical machine. By "isolated" I mean not used for anything else and not connected to any network. Make a fresh install of the OS, do what you need, but then never use the machine for anything else. I would assume that "really malicious" software would modify the recovery partition, bootloader, and even the firmware.