I'm not on a vulnerable user, but I'd prefer not to run RCE's on web pages I'm browsing which aren't presented as containing the RCE, even if they are doing it to notify me of the vuln.