While reading I also noticed the '=alert("foo")' hack, and thought I'd be able to point it out first, but you beat me to it! Ah well, that could be fixed pretty easily if it were harmful enough.

I think it's time that we accept the browser as a platform development model. Now Apple has 'iWork for iCloud' and Google has had it's doc programs for a while.

Very good hack, very powerful idea.