Couldn't someone doctor up a zip file directory listing containing something like "</pre>" and XSS us that way?