This looks like a supplement only for innerHTML method. Using the DOM to produce DOM artifacts has always produced clean markup. The risk here is if the string

This looks like a supplement only for innerHTML method. Using the DOM to produce DOM artifacts has always produced clean markup. The risk here is if the string is untrusted you are pushing untrusted and potentially risky code onto the user. The only silver lining is that now it may not break the page.