[javery]

You're correct - it can do just about anything. Technically it can't make ajax calls back to a domain other than where the page was served from - but you could get around that by just inserting more javascript tags.

iFrames do offer a little more security here - but in this case I would still go for just script since I don't see that the downsides outweigh the added security. (you can still do a whole ton of damage from an iframe)

[JoshTriplett]

What damage can you do from an iframe? You don't have any of the permissions of the site containing the frame.

[javery]

You can deceive the user pretty easily with content that looks like the main page and prompts them to do something you want them to do. (like login to the parent app even though they are logging into your app, anti-phishing stuff won't take effect if you keep it all in the iframe)

You could also just execute whatever JS you want if there is a browser vulnerability you want to take advantage of.