“And interestingly, Chrome (even Canary) still allows the user to run javascript from the omnibar.”

Worth noting that they remove the "javascript:" part when you paste from clipboard.

My guess is that it protects against people telling others to "copy this in the address bar to steal your friends' Facebook accounts", much like why Facebook disabled the console previously.