To add to Andrew's post (he is correct btw), Historically there have been a few "VLAN hopping" exploits that allow a user to jump from one VLAN to another. I know of no current methods as long as you follow best practices, particularly enabling port security and limiting the number of MAC addresses per port. Also, all of the exploits I have known of relied on access to a device on the switch, so an attacker could compromise a web server and then use it to hop to another VLAN.
For these reasons, I always recommend separate switches for each security zone, but I often advise that it is not cost-effective for my smaller clients. I trust that a properly secured switch is not currently a risk, and if you use some host protection such as CSA on at-risk servers, a successful attack would be very unlikely.
As a bare minimum, I like to have 1 external switch if necessary, an inside switch (may be your existing core or other internal switch), and one or more for DMZs. The DMZs usually have multiple VLANs with a trunk to the firewall to allow for more security zones than allowed by the physical ports.
I hope you find this useful,
Eric
