When I redefined alert to return false, it crashed Chrome pretty bad (note: I am not the owner).
If someone really feels like policing it, they can delete the iframe element (in FF, chrome, or opera) and just have access to the editor panes (which means no alerts, redirects, or other nastiness). I'm sure someone can figure out how to write a javascript snippet that will post some text that has been cleaned of all instances of "window.location", "alert", and probably "while". (I would do it myself, but it's 1am here).