In addition to the other replies, there could be server-provided HTML that the user has the option to change, and initiating a change, activating the vulnerabil

In addition to the other replies, there could be server-provided HTML that the user has the option to change, and initiating a change, activating the vulnerability, could be one click. (this happened to Google's own search bar!) Then there are cases of different browsers parsing things differently and/or bad sanitization/serializing giving different results on repeated invocation or just being broken on the server-side. A simple client-side option is gonna be a lot simpler.