Cross-site scripting via hardcoded front-end watched expression.