chromium/third_party/blink/web_tests/http/tests/xmlhttprequest/web-apps/resources/018-test.xml

<html xmlns="http://www.w3.org/1999/xhtml">
 <head>
  <title>PASS</title>
 </head>
 <body onload="this.ownerDocument.title='FAIL'">
  <form action="javascript:alert('FAIL')" onsubmit="this.firstChild.data = 'FAIL'; return false;">PASS</form>
  <script>alert('FAIL')</script>
 </body>
</html>