[mbq]

_Arbitrary_ SVG is a security/privacy problem -- it may inject JS or exploit quirks in rendering to manipulate site contents, import external images and fonts, or simply be a render bomb. And it is hard to filter out those problems.

[nwh]

You could just have a dedicated domain for it, then there's no risk of XSS. It's doable, but it would be rather fragile.

The render bomb point is a little trickier, as you can use some detailed filters to crash most browsers. Heck, even a single simple shape will crash any version of iOS.