I bet it can also be an XSS attack vector. Imagine that there is some piece of jQuery-based code that evaluates selectors based on the ID attribute of a given element (e.g. for this element find all the related ones):

  $('.' + div.attr('id')).each(function() {
      $('body').append($(this); // Moving elements
  });

Now imagine that I give the id attribute the following id: 'nada,<script src="evil.js"></script>'

I suppose this is a bit contrived but still fun.