Its particularly interesting in that it gets ALL my local ip addresses. This seems quite dangerous. Could they just start probing around my local network or does cross domain stuff kick in?
Edit: I realized I didn't take this to its full conclusion. Guess the router's IP, exploit XSS to open ports on the router to your machine (JS knows your local IP already), carry on escalating from there.