chromium/third_party/blink/manual_tests/inspector-wrappers/inspector-hasAttributes.html

<html>
<head>
<script src="inspector-wrappers-test-utils.js"></script>
</head>
<body>
<script>instructions({trigger: "Collapse and expand the &lt;body/&gt; tag"});</script>
<script>
  _hasAttributes = document.body.hasAttributes;
  attackfunc = function() { 
    try { doAttack(); } catch(ex) { }
    return _hasAttributes.call(this);
  }
  document.body.firstChild.hasAttributes = attackfunc;
  document.body.hasAttributes = attackfunc;
  document.body.parentNode.hasAttributes = attackfunc;
</script>
</body>
</html>