At least this script in particular seems pretty harmless. I glossed over the "rainbow links" code, so maybe there was something vicious in there.

Either way, XSS sucks. Surprised that they haven't plugged this one yet.