That does make me wonder whether we've got an injection vector here. I suppose one could only inject code into their own browsing session this way, though, eh?