As you think about this, consider the impact that plugins, that your JS doesn't know about, and how they play with the entire runtime of the browser.

Also, I find this blog post somewhat less than amusing in general about how browsers work: http://lcamtuf.coredump.cx/postxss/