Usually the script would be remote (script src="..."), and the same origin policy would prevent you from getting its source in a similar way.