Well I just quickly tested, and NoScript doesn't seem to block that, whereas it would if it were externally loaded or inline JS on a web page.
So that's one difference. Not that the type of person to use NoScript would likely paste obvious javascript into the address bar...
Edit: Doesn't look like you can create a valid URL with that format, but it can be launched via pasting in (obviously), a bookmark (which the contents of which could be obfuscated by telling a user to drag an image to the bookmark bar and click it), and can be launched via command line, e.g.
So that's one difference. Not that the type of person to use NoScript would likely paste obvious javascript into the address bar...
Edit: Doesn't look like you can create a valid URL with that format, but it can be launched via pasting in (obviously), a bookmark (which the contents of which could be obfuscated by telling a user to drag an image to the bookmark bar and click it), and can be launched via command line, e.g.