People can and will go nuts if you, for instance, accidentally mess up the DOM for their customers by getting an XSS payload cached and redisplayed in e.g. "saved search" results.

It sucks, but if your goal is to avoid legal drama, don't test without permission.