I mean, I fully acknowledge that this allows the user to execute arbitrary JavaScript (for the most part) _but_ it also has to be configured by them before the ZeroClipboard.swf is added to the page. So far as I can tell, it really falls into the same field as the other notes in the [security.md](https://github.com/jonrohan/ZeroClipboard/blob/master/docs/security.md): if your global JS execution space is compromised, then you're in trouble.

The only other potential problem that comes to mind is if they did something like manually loading the ZeroClipboard.swf ahead of time (outside of the ZC JS library's control flow) and passing in malicious values...?