It works well on localhost.
According to [Same Origin Policy](http://www.w3.org/Security/wiki/Same_Origin_Policy#Details):
>  `<script>` element can execute content retrieved from foreign origins, which means web sites should not rely on the same-origin policy to protect the confidentiality of information in a format that happens to parse as script (e.g., JavaScript source files, JSON format, JSONP services, or JavaScript/gif polyglots).