As long as only

The values displayed in the list box...

(emphasis mine) are affected, which I read as corresponding to the values %Labels, I should be fine...

But nitpicking aside, you are right, I did miss that bit and it's probable consequences for the server accessability of the stuff to give back.

why are you're using a hidden field and not the session to send data from the script

It enabled me to present a minimal working example, without introducing another (not already mentioned) module.