This is indeed nasty/evil ;) and would have harmful consequences, because:

* overwrites window.onload
* unconditionally executed on the/any page whenever loaded
* missing verification of dependencies; i.e., whether comment-reply.js has been loaded already and whether the reply link is actually the intended reply link -- clicking a *"Reply"* link without that script will actually cause the browser to navigate away
* is (unintentionally) overwritten/replaced by an equally evil script ;)