If someone uses this trick to upload a PNG like this to your server, and that person is tricked into running it as HTML, then that HTML has access to your cookies and can make make AJAX requests (circumvent same origin protection).
If user content is on a separate domain, they can't do that.
Also fishing is a lot easier when you're on the real domain...
