JSON has a simple ... other JavaScript code, that code is executed by the script. This might give the hacker access to all the variables a script has access to, potentially compromising a user's PC.