The content can be anything like
var mywindow = window.open('', '_blank');
Which will diplay the alert box in this case, but it's only shown to the user, that supplied the content. For example, if someone was to type in HTMl to see how it looks it will show how it looks in the new window that pops up.
I feel like I'm being overly cautious, but that's a good thing, Just want to make sure I'm not missing something in this situation.