Any (machine) code can call private APIs, so it's simply a matter of getting/hacking Nitro to generate the correct machine code to do it. I think that's what th

Any (machine) code can call private APIs, so it's simply a matter of getting/hacking Nitro to generate the correct machine code to do it. I think that's what they would worry about. Remember Jailbreakme.com? It was PDF (and kernel, so no sandbox could have helped) I believe, but a real problem to consider if you can get custom code running.