If you would make custom tags and allow users to load a web page within a post you might as well just turn on HTML in posting for everyone. If someone wanted to execute some bad code an they were not allowed to do it as HTML is off but you are able to pull in a web page using an IFRAME tag then they would do it that way.
Years ago this was used to execute a javascript code in a community and used to grab the Host's user names and passcodes, it worked very well and caused big problems in that community as the grabbed data was sent off to a perl program running in a different location on the internet.
I'm assuming when you say by grabbing the host's user name and pass codes - thats for the web server where the web site lives, but why not just implement a browser functionality. So just as a browser loads a page why would there be any problems ( do you mean performance issues ), I guess I'm not clear on the latter part of your statement. But don't we load pages without difficulty in our browser window - and isn't it possible to replicate that.
]
