It can execute arbitrary JS in your browser using eval(), that could be why.