Don't forget that you've just given people a way to run random code in your process, so if this is a private extension point for you then check public key signatures when loading, if you don't trust the people writing the extensions take steps to protect yourself.