Hi Chris,
Although it is possible to inject additional content into the frame, I would strongly discourage it for a couple of reasons: Firstly, although the frames are presently rendered on the same host as your parent page, we also don’t display any user-identifiable information in the timeline. If we add features in the future that depend on a Twitter user’s identity, we will likely change the frame to load from a twitter.com subdomain instead, to protect a user’s identity. In that scenario, the injection will cease working and you’ll run into a cross-domain communication error.
Similarly, we’re keen to embrace lighter-weight forms of sandboxing the styles than iframes once Web Components, css reset:all and any other options stabilise and gain browser support.
We’ve added more customisation options for working with custom backgrounds, hiding scrollbars, and for limiting the number of tweets: https://dev.twitter.com/docs/embedded-timelines