Cross-protocol XSS with non-standard service ports

I believe that with multipart-formdata encoding turned on, you could send your entire FTP exploit in one form variable, newlines and all, because they won't be escaped on the wire.