Nothing, and IIRC this is what I've seen recommended on Dev Forum. Browse to plugin, copy plugin to app sandbox (or with 10.7.3 maybe get new security managed context handle to FS object), load. I don't have an app that does this so I can't comment on any possible issues around code signatures.

Sorry I can't point to individual forum threads at the moment.