It's a very interesting feature!
The problem is the time it will take for us to be able to use it in a production service...

Just a small correction:
It's called Cross Site Scripting [XSS] (see: http://en.wikipedia.org/wiki/Cross-site_scripting)

Another problem that comes in the "bag" is Cross Site Request Forgery [XSRF] (see: http://en.wikipedia.org/wiki/Cross-site_request_forgery)

Probably you already know them, just for reference and context for some readers.
