This is the worry a lot of people have. The only real saving grace is that copying in JS to the address bar doesn't execute the code, and it's a bit of a pain to get bookmarklets bookmarked.