How much data can I send from the browser through unityObject.SendMessage()?

I want to download content into the Unity web player from a web site that does not host the web player/game. Thus, I have to do the download using something like JSONP from the enclosing web page, rather than from within the plug-in.

So, I imagine that my game will call out to the JavaScript in the browser to start up a jQuery JSONP fetch request. Once that request completes, I need to call unityObject.SendMessage() to send the data back in.

Is there a limitation to how much data I can pass in as a string in this SendMessage() call? I'll likely want to put in hundreds of kilobytes in one go, representing things like a mesh, or a texture, that would be dynamically provisioned from some other site under my control.

I know how to secure the web player against maliciously injected content from rogue hosters, although it seems as if SendMessage() can be used to send arbitrary messages to arbitrary game objects, and thus every game object method would potentially need to worry about this kind of attack. I think it would be better if there was a narrower interface here... but that's beside the point in this question: How big a string can I cram into unityObject.SendMessage() and expect to get away with it?

As far as I can tell from a quick look, our code does not impose any limitations (other then a 32-bit size field on strings) on SendMessage, thus theoretically allowing up to 4GB of data to be sent this way. In practice, this will very likely also depend on browser and JavaScript engine limitations, and I may well have overlooked something - so the only way you can be somewhat sure of this is to go and test it across various browser and OS configurations.