Yes, like steal peoples login information and embed popup flash videos and a thousand other malicious things HTML allows.