DOM warning (documentation)

[natevw]

Might be worth making clear that passing any sort of DOM object to the untrusted script is dangerous e.g. script injection via .innerHTML and probably many more avenues…. (Although, how much will our iframe mitigate of that?)

[natevw]

For just one other example: https://www.w3.org/TR/html5/webappapis.html#internal-raw-uncompiled-handler