JSON objects are often created from XHR responses and then flowing into the DOM (potentially without escaping).
It would be quite helpful to know the path/context of the tainted string within the JSON object, e.g. as part of the arguments:

Ideally, the context information would be a kind of XPath for JSON as described here.