Sandboxing doesn't help against malicious code that changes expected behaviours or corrupt data.