third_party/blink/web_tests/fast/loader/javascript-url-in-object.html

<script>
    if (window.testRunner)
        testRunner.dumpAsText();
</script>
<p>This tests that javascript: urls in an object tag do not get executed.</p>
<object data="javascript:alert('FAIL - javascript: url was executed.');"></object>