<html xmlns="http://www.w3.org/1999/xhtml"> <head> <bindings xmlns="http://www.mozilla.org/xbl"> <binding id="g"> <implementation> <constructor> throw 3; </constructor> </implementation> </binding> </bindings> <script type="text/javascript"> function boom() { var HTML_NS = "http://www.w3.org/1999/xhtml"; var span = document.createElementNS(HTML_NS, 'span'); span.style.MozBinding = "url(#g)"; document.removeChild(document.documentElement) var w = document.createElementNS(HTML_NS, 'body'); w.setAttribute('onload', "/"); document.appendChild(span); } </script> </head> <body onload="boom();"></body> </html>