@daleharvey @mozsquib ...what happens if the remote service isn't CORS enabled and only offers JSONP?

Regardless of whether or not it's a security issue, you can still do JSONP with this or anything that loads scripts with a script tags. Not removing the script element just means the heap will grow with every request.