Scary exploit! Would it also work using Element.scrollIntoView()? In such case it wouldn't even need user interaction.