In recent browsers you can certainly kill just one tab's JavaScript without taking out anything else.

It doesn't feel very different to printing a PostScript file to me. You're giving someone access to run their "arbitrary code" in a VM on your system with very limited permissions.