DOM sink (eval)

Inject through the fragment: /lab/sink-eval#fetch(...)

evaluating location.hash