Post the malicious code with a note saying it is malicious. Avoid posting something in a form that a click-happy user may be tempted to run (e.g. a snippet or a link to a compiled binary or something).
For example, don't link to a fiddle that catches the user's computer on fire; just post the code and say "this will catch your computer on fire if you run it". You don't actually have to trick them into emptying a fire extinguisher on their desk to get the point across (it's true, you don't).
This works because:
- Those who have sufficient knowledge and motivation to understand why it's malicious don't actually need to experience it in action to get the point (this was the, IMO invalid, argument used by the poster in the OP's linked question).
- Those who do not have sufficient knowledge or who do not care can at least read the note and know to Not Try That At Home, even if they don't know or care why.
Those who do not have sufficient knowledge or who do not care, and who also can't be bothered to read the note, will at least not be presented with something they can click on to trick them.
Those who do not have sufficient knowledge or who do not care, and who read the note but can't be bothered to take it seriously, and go through the trouble of putting the code in an executable form and running it, well... we put up the caution tape and closed the elevator doors, and they pried the doors open and threw themselves down the open elevator shaft anyways, so...
An important point is: While you can attempt to make an argument that says "the best way to demonstrate the maliciousness of the code is to immerse the user in the malicious experience", this argument does not hold because the people that it matters to do not need the first-hand experience, and the rest of the people wouldn't benefit from it anyways because it doesn't matter to them in the first place.
So just post, leave note, and post in a way that requires at least some threshold of effort to execute (the latter is important; if a person is going to copy some JavaScript, paste it in a text file, and run it, at some point in that process we have to limit how much we can protect people from themselves - we can provide people with a first line of defense against themselves but that's about it unless we start getting community volunteers to physically stand behind users and look over their shoulders).