When you think about it, what does your web browser do? It is downloading someone else's code (Javascript, Flash...) and executing it on your machine. Somehow your trust the browser. Why not trust the virtual machine? Maybe if the company only allows Javascript to be executed on the virtual machine, people might feel more comfortable about the idea.