PDF is required for JS to run due to code generation in the PDF rendering pipeline facility.
Does the JS run in a true sandbox? Inside, outside, or beside the usual browser sandbox? Are network requests allowed? Filesystem access? Are granular permissions required/available?