I agree... You can only validate what is presented to you; a hacker won't kindly hand you a piece of code to run after exploited a hole and ask you to verify it.

It also rather circuitous, browsers already verify what they are executing.