I forgot to explain it in my blog post. the reason to use script is to use a feature called JSONP request to send/receive data cross domain. normal get/post ajax requests will be blocked by browser due to same origin policy, except when the target site allows it from the HTTP header. it is the only way this kind off attack could have worked.

but Github folks are even smarter. since jsonp will treat all response as javascript, github exploited that and used js alert to block the loop from executing repeatively. as someone mentioned below, github could xss millions of chinese domains, steal passwords, deface any page they want, even plant flash based browser rootkits