I was thinking about that too. Although any form of delivering automatically executing code is just another attack vector. It's macro's all over again.