606430-1.html (520B)
1 <!DOCTYPE html> 2 <html> 3 <head> 4 <script> 5 6 function boom() 7 { 8 var r = document.documentElement; 9 var i = document.getElementById("i"); 10 11 document.removeChild(r); 12 document.appendChild(r); 13 w("dump('A\\n')"); 14 document.removeChild(r); 15 w("dump('B\\n')"); 16 document.appendChild(r); 17 18 function w(s) 19 { 20 var ns = document.createElement("script"); 21 var nt = document.createTextNode(s); 22 ns.appendChild(nt); 23 i.appendChild(ns); 24 } 25 } 26 27 </script> 28 </head> 29 30 <body onload="boom();"><input id="i"></body> 31 </html>