This is not a hack it's basic Javascript.

If a malicious hacker can insert some script in a trusted page, security is pretty much completly broken and you have other worries. The fact that you can make links in this page point to other malicious pages seems like a small problems as most people won't even check the domain before clicking the link.

I would think that some users are most likely to check the address bar after clicking the link. But my dad would probably woudn't see anything.