Running JavaScript from inside an image? What could possibly go wrong?