I think the burden lies on the browsers to warn average users of the danger of pasting javascript code. Perhaps a popup confirmation the first time you paste `javascript:...` in the address bar with a "Never ask again," and a warning that "Here be danger" when you open the dev console that you can dismiss.