The Tor Browser Bundle includes noscript, but by default it is configured to allow scripts.
You can configure it yourself to disallow scripts, but you should be aware that if you start whitelisting sites, your whitelist can be used as a sort of user fingerprint.
Scripts should not be able to get your real IP address in the TBB. If they can, that would be considered a serious bug.
It makes it far more likely that a site owner will be able to track you.
There are also risks from bugs in the Tor browser..
It's easy for a provider to tell you're using Tor because the Tor exit nodes IP addresses are published (by design). Tor gives you some anonymity by making it difficult to identify individual Tor users, who are many. Anything you do differently from the majority makes it much easier to identify you when you return to the same site later.
The do not automatically know you ip, but you do run the risk of encountering java/flash exploits that can be used to try to get your ip. All though they do try their best to prevent it from happening.
The tor blog covers these issues as they arises.
Which scripts are the most dangerous?
- Scripts which target tor, etc. The reason is self evident.
- Scripts from social media. We all know social media is inherently vulnerable, and governments use it. (Reference several pieces of news - you can look them up yourself.)
- Scripts from websites you don't trust. You either do or you don't.
- Last but not least - your own script. Your behavior on the web can be used to track you. Especially if you make starpicular spilling mistooks. ;)