This post seems to be hinting that this is potential security issue, but I'm not sure how it would be. All I can imagine this buying you is the ability to serve JS from someone else's domain, but the domain JS is served from doesn't change its security privileges; that's based on the domain of the HTML file the JS is included in.