Here's a question:
A Java VM is required to validate all compiled programs before executing them, because one of the goals of the Java language is to allow execution of untrusted code.
How much damage could you do by maliciously hand-crafting a compiled Lua program and feeding it to the interpreter?
Thanks,
Gé