<img src="x" onerror="alert(666)">