var s = "<html><b></b><b></b><b></b>";
var div = document.createElement("div");
div.innerHTML = s;
alert(div.getElementsByTagName("b").length);
I’m not sure how reliable this is. Sounds dangerous though to just allow completely unfiltered content from another domain. Think about all the bad stuff it could contain, like scripts/media.
Actually, this is for a Greasemonkey script… hell, actually, I may just make it a .html file that people load locally from their hard drive, so not even greasemonkey.