It's also a potential cross-domain attack vector if you let your users insert arbitrary code. See, for example, why github pages was switched from `.com` to `.io`: https://github.com/blog/1452-new-github-pages-domain-github-...