If you allow a browser to open sockets to random places, it's the exact same principle! The onus is on the listener to ensure that the people communicating respect the agreed upon protocol.
http://www.adobe.com/devnet/articles/crossdomain_policy_file...