XSS from JSON outputs
In the book “XSS Attacks – Exploits and Defense” Jeremiah Grossman writes:
The exploit found in Google’s reader was due to the developers thinking that JSON was only going to be viewed by the calling script.The developers never realized that attackers could send users directly to the JSON output. While AJAX and JSON do not generally introduce new holes per se, they definitely can increase the attacker’s surface area.
I thing there is no way for the attacker to force victim’s browser to run javascript from JSON directly. Is there any example that shows the authors intended purpose?