Uhh, it's possible to inject Javascript into this. There are two people that already did this. One is harmless and alerts "Wufff!" and the other redirects you to pornhub.
[edit] Now there's another that redirects you to lemonparty.
[edit 2] Now there's another that redirects you here. It's fun watching this play out live, with the nice vs. the mean HNers.
Shameless plug: We develop a tool that detects vulnerabilities such as this automatically (even in JavaScript based web apps) - https://www.netsparker.com/netsparker/
There is also a free community edition which would possibly detect this vulnerability : https://www.netsparker.com/communityedition/
Pro-tip: Escape all user input either when it's going into the system or when it's going back out to be displayed!
Sorry for the slow security fix, I was traveling after leaving YC Hacks. Please do let me know if you find anything else wrong.