Interesting. I never thought of that. It seems almost silly that you're bringing insecure content over a secure channel like that but then again it is only images.
"only images"
As long as they don't do WMFs, with their code-injection-by-design functionality...