I\'m aware of dynamic script/css loading by adding or tags to head or body of the page, but then it will be executed by
You can also use an iframe and use the script/css URL as the src of the frame (so it isn't evaluated/applied at all), although you'd want to be sure in that case that the JavaScript/CSS was delivered with Content-Type text/plain to avoid unfortunate things happening with < characters and such. Although you should run into SOP issues with this approach as well, on a decent browser, if the iframe src is from a different origin.
Other than that, I think you largely have it covered with the options you list.