Hacker News Reader

I see. Genuine question: I haven't thought this through but why not just execute the file in the context of the original file?

Because if the file was legitimate, the site might need it to run under its own context.