What you're describing is known as a mixed-content vulnerability, which allows an appropriately positioned third-party to replace the content with whatever they chose. In the case of something like an included JavaScript file, you're negating most of the security provided by SSL.
See: http://googleonlinesecurity.blogspot.com/2011/06/trying-to-e...