XSS danger. Message includes user-generated content (e.g. names of things), which could contain JS.