I didn't have to enable javascript to play the video (chromium), all you have to do is create the video element and load the source. Then all extra commands can be loaded with javascript.

<video controls> <source src="video.ogg" /> </video>

<script> function load_video_extras() { ... } </script>

How, why? Why not just host the Javascript yourself to prevent XSS attacks.

I'm missing something here - why would this be less secure then any other JS lib?