Directly writing exceptions to a webpage without sanitization allows for a cross-site scripting vulnerability if the value of the exception can be influenced by a user.

To guard against cross-site scripting, consider using contextual output encoding/escaping before writing user input to the page, or one of the other solutions that are mentioned in the references.

The following example shows an exception being written directly to the document, and this exception can potentially be influenced by the page URL, leaving the website vulnerable to cross-site scripting.

OWASP: DOM based XSS Prevention Cheat Sheet.

OWASP: XSS (Cross Site Scripting) Prevention Cheat Sheet.

OWASP DOM Based XSS.

OWASP Types of Cross-Site Scripting.

Wikipedia: Cross-site scripting.