Couldn't any link point to anything that runs arbitrary code? Does it matter if it's on jsfiddle or xyz.com?