Comment by deepmacro

It can execute arbitrary JS in your browser using eval(), that could be why.