How I got the turntable.fm gorilla in less than 48 hours 15 years ago
it sounds like they could avoid user code accessing the room manager by wrapping it in an anonymous function, so their code wouldn't be accessible to other javascript.
however, this analysis isn't really complete without looking at the http traffic that accompanied these script calls.