In the pre-IE8 days, you could include CSS expressions within CSS that let you execute arbitrary Javascript when the CSS was evaluated.  This was a very common vector for Internet worms; UGC sites would think they were safe because they stripped out &lt;script&gt; tags, javascript: URLs, and inline event handlers (onload was another common attack vector), but then an attacker would add a custom style attribute with a CSS expression and pwn your computer.<p>That specific danger has largely gone away (except on all the corporate networks that are still on IE6 because custom apps), but there&#x27;s still a desire to minimize attack surface.  What if calc() or var() is found to have a bug in the future that allows arbitrary code execution?