Except, if you are running customer supplied code on the instance then you've made the sandboxing problem that much more difficult.

I'd much sooner have a clean VM to run my tests on than have to think about the ways the previous user might have left things in an insecure state.