The minimal "expressive power" required to pull off the simplest exploit is just a way to capture click events. That would be quite restrictive indeed.