That seems like an uncommon scenario for the kinds of things NACL gets used for. These are intrinsically server-controlled applications, when they're applications at all (my real sense of what NACL is about is "another tool to migrate away from things like Flash and plugins; ie: a platform for video codecs).

I see your point. I guess you're saying, there could be a photo editing app in which Alice can send pictures to Bob, and Mallory might send a malicious picture to Alice that coerces her client into betraying all its photos.