I should be more clear. The scary thing is having malicious sites exploit the functionality. URI overflow attacks and Gifar attacks can be exploited at the website level. Exposing this functionality to the developers is unnecessary. If a developer wants to run as a native application, then they should. Not run as a chrome plugin pretending to be a native application.