[Admins]

Joining classes works on clientside, but with 4.20 the onCreated() thing is not necessary called when the script has not been loaded yet. In the next Graal version clientside classes work much better (I'm using it for customized gui controls and such stuff).
About security: client-side objects can join any class that have a clientside script. It shouldn't really be a problem because (1) you need to be able to write the script that calls "join", so you basicly need RC already, (2) in that case you could also easily call join on serverside, so you don't win anything, and (3) even if someone hacks the client and manages to join another class, he/she can only use scripts which are meant for clientside stuff anyway, (4) it might be possible to add a server option to restrict client-side joining to certain classes, although I don't see a case where that could be necessary