Earlier quoted context omitted.
Sounds smart. It's extremely easy to get an unsophisticated user (heck, any user who isn't a web developer) to paste a random string of junk in to their URL bar - and doing so is a very nasty XSS vector that works no matter what precautions a site's developers have taken. I'm sure I've heard of this attack being used successfully on Facebook, spread through messages that say "paste this in to your URL bar to get X".
So those messages will say "press [whatever key combo activates the console] and paste this text there for a funny video" instead?
Or possibly "drag this link to the toolbar and click when on any page on Facebook to see which of your friends is viewing that page" or whatever.