If you can control the src attribute of an <img> element on someone else's site where people use IE6, they're way more fucked than just having their browser cra

If you can control the src attribute of an <img> element on someone else's site where people use IE6, they're way more fucked than just having their browser crash. In IE6, <img src=FOO> is a superset of <script src=FOO>. Really.