- Many browsers (recent Chrome versions, maybe also Firefox) won't even load the script by default
- an attacker can intercept the script, and replace it with — for
example — another script that will simply copy the entire
<body>contents of your https page, rendering https useless if the first place. Or they can redirect the visitor to an entirely different, attacker-controlled site. Most visitors wouldn't notice the change in the URL and continue interacting with the attackers site, potentially giving away their password or other sensitive information.
Anyone that can become a man in the middle can perform http manipulation. Check out mitmproxy for an example of how scripts, css, java applets etc can be inserted into an insecure connection. This is possible because http is a plain text protocol and as such can be manipulated by anyone that controls a transit point on any network used to reach your destination. SSL provides end to end encryption thus mitigating against such an attack. ARP cache poisoning is one way that an attacker that shares a network with you could pull of such an attack. In this type of attack the malicious party sends out arp packets that appear to be from the IP address of the next hop router. It causes your PC to send packets to the attackers machine where they have the ability to intercept and change data in transit. This would allow the attacker the ability to perform such an injection attack on an unsuspecting user. Any router that is between yourself and your destination could perform such an attack as well, but is unlikely unless it has also been infiltrated by an attacker.
Also check out ettercap this tool has been designed to perform ARP attacks and when combined with mitmproxy you can simulate this type of attack rather easily.