This goes a lot farther than disabling CORS checking: it turns off all same origin policy enforcement.

So, ex, if site A opens a tab on site B (and so gets a reference to it), site A can read and modify anything on that page. Or, ads loaded in cross-origin items could read and modify anything on the containing page.

It's fine for testing, but don't log into any real accounts in this profile!