> They're "secure" (meaning we let anyone's javascript code just run in our browsers, even embedded in other people's code, and seriously expect no ill effects)

I don’t expect that. Use after free vuln + heap spray + shellcode = Ill effects