Javascript is pretty well jailed up, you can't communicate with local and remote files in the same javascript file.
If my document reader can execute any code in any language, then any document that I read has the potential to execute malicious code on my computer, and I now have an exploit vector that I need to consider when downloading documents & opening e-mail attachments.
I understand that the code can be sandboxed, but before I implicitly trust the sandboxing technology, I'd have to see an example of an unexploitable sandbox. I don't know of any - but that doesn't mean they don't exist.
http://www.informationweek.com/news/security/attacks/2295000...
Edit: It's implemented via Mobile Safari, as pointed out by justincormack -- this comment is invalid.
More accurately: all increasing of capabilities in non-immediately-apparent sources IS cause for concern. But that has to be weighted against the exhibited competence of the vendor. I find it unlikely that we-vet-everything our-brand-name-is-safe-computing-experiences Apple wouldn't have considered security in this move.
It uses CSS3 columns to make the pages going across.