This applies to you if:
* You have a S3 that was NEVER upgraded to 4.3 or later. (Smile. You're about to be richly-rewarded for obeying XDA's #1 rule: NEVER allow an OTA update from your carrier to get installed. If the phone is already shutting down, yank the battery out.
* You don't want Knox now, but would like to keep it available as a future option so you can repurpose your old S3 as a wifi-only device for checking your company email or calendar at home, and running all the intrusive, performance-killing enterprise apps you'd never allow anywhere NEAR the phone you actually use in real life.
The good news:
* You can install the MJ2 bootloader, the MJB radio modem, and a 4.3 (possibly 4.4) AOSP-derived ROM that has every scrap of Knox stripped out of it. Not all ROMs fall into this category, and you still have some research to do (especially if you found this post via Google, and more than a few weeks have elapsed since the time it was written), but have faith... they exist, and it IS possible.
* Unlike the S4 and newer Samsung phones, a S3 with an older bootloader has no concept of Knox or its evil e-fuse. As long as you don't flash a Knox bootloader to the phone, there's no Knox e-fuse to blow (it's not a real e-fuse, anyway... it's just software running under ARM TrustZone pretending to be a fuse). You can enjoy a life of rooted sin and freedom, then wipe the slate clean by flashing to MJB (or later) and Samsung's stock 4.3 or later ROM when/if the need arises someday.
Now, skip to the third post by Larry2999 for a good solution.
Tip: download the MJ2 bootloader now, even if you aren't ready to use it yet. Remember, things like this have a habit of disappearing without warning.
(original opening post, for the sake of historical context)
Is there any way to reflash a S3 that still has 4.1.2 and whichever bootloader was the current one circa mid-September of last year to a 4.3 or 4.4 ROM in a way that preserves the ability to flash Samsung's official Knox-enabled bootloader and ROM to the phone at a later date?
In other words... I don't need Knox enterprise capabilities NOW... but I'd prefer to avoid permanently burning the Knox bridge behind me if I can. I've kind of put off upgrading until now for this exact reason, but now AT&T is hitting me with "screw wi-fi and a fully-charged battery... we don't CARE if we brick your phone. We're going to forcibly reboot it and install 4.3 in 30 seconds unless you yank out the battery first" dialogs (not quite AT&T's wording, but pretty close to the meaning).