There are already plenty of public DNS records which resolve to 127.0.0.1. They're offered as services. For example, 37Signals have a domain resolving to localh

There are already plenty of public DNS records which resolve to 127.0.0.1. They're offered as services. For example, 37Signals have a domain resolving to localhost. Malware on a user's computer already has access to everything the user has. Malware on a website would be blocked by the mutual authentication and origin checking that Dropbox do after establishing the WSS connection. Malware in the form of a local daemon on a public computer where someone logs into Dropbox will not be able to authenticate with the web app.