They could put all executed code in a cookie-less domain, that way it can't access any private resources on your behalf (modulo XSS bugs on other sites). This is what the Google code playground does:

http://code.google.com/apis/ajax/playground/

We use different domain for displaying fiddles.