It's the browsers job to run untrusted code, this is why there are sandboxes and all kind of security-mechanism. This case is about a questionable intentional hole in the sandbox, which can be used for a social engineering-attack. Inject some code in a text-buffer, and hope that the user will execute it, and not see the malicious part. Not the biggest attack-vector, but an annoying one, which should be able to fixed easily.