Comment by rafram

Not just that - seems like it allowed running privileged JavaScript (full access to your system) on the preferences page as well.