Inject through the fragment: /lab/dom#<img src=x onerror=...>. <script> does not run through innerHTML.