Even some same-origin things, for example input type=file, which can reveal paths on the local filesystem, would have to be blanked out.