Someone might as well find a vulnerability in a Javascript engine. What's your point?