Using a .user.js file sent as text/html, it's possible to create a page that will look like a normal plaintext file with a harmless script while hidden JavaScript with malicious code can be run instead once installed.
Greasemonkey offers to install this file without checking that the text displayed has content-type text/plain or equivalent.
Example: http://simon.arlott.org/src/gm/hidden-script_greasemonkey-0.6.4.user.js
Patch:
Content ©2008 Simon Arlott. Re-use permitted under a Creative Commons licence: Attribution-NonCommercial-NoDerivs 2.5.
Design ©2008 Simon Arlott.
Re-use permitted under a Creative Commons licence: Attribution-NonCommercial-ShareAlike 2.5.