Note: these arguments only apply to JavaScript in a browser (and at that point, apply to virtually any client-side system attempting to somehow protect information from being snooped on by the server that dynamically provides the code to execute on the client <- an idea that should have been preposterous from the start ;P).
http://www.matasano.com/articles/javascript-cryptography/
that explains some of the issues with JavaScript-based cryptosystems.