There's no better way to explain this than to show it in action:
var Foobar = 'foo';
Welcome to script injection!
What's the bad news? The auto-format indentations will be destroyed if you click the Auto-Format button, even though it is supposed to be secure inside the CDATA tag. To keep this from happening, do a search on the script for all TAB chars and replace them with 4 spaces… Auto-Format won't touch them after that.