That was my thought. Since you could also convince them to paste "javascript:..." into their URL bar and that's not an issue to Google.