GreaseMonkey has to contend with these same issues. It has a security model, which will be broken if developers ignore the list of things you can't do.

http://wiki.greasespot.net/Security