<script> tags aren't subject to cross-domain restrictions. Think about it - all those website statistics scripts are hosted on external servers, but their Javascript gets executed just fine. By dynamically inserting <script> tags into the page, you can force Javascript from another domain to execute in your domain.