I'm not sure if this is an issue with Google Docs or Drive, or whether it's the result of an API call made within the script (other than the replacement of text, I couldn't find anything "destructive"), but the permissions that the user needs to grant the script seem overly broad for code that's intended to create one document from another (see image).
