| <!DOCTYPE html> |
| <!-- |
| Javascript indirect image loading. |
| |
| 3a.js defines fn1(), which adds an <img> tag to the body. 3a.js also |
| inserts a script tag with 3b.js into head (between the scripts for |
| 3a and 3c). 3b.js itself creates an <img> tag which directly adds it |
| to the body. Finally, 3c.js defines fn3(), which |
| modifies <img id='img3'>. |
| |
| Note that as 3b.js adds a tag to the body, it is executed only after |
| the body has been parsed. No, I don't know how that works either. |
| --> |
| <html> |
| <head> |
| <script type='text/javascript' src='3a.js'></script> |
| <script type='text/javascript' src='3c.js'></script> |
| <img src='' alt='' id='img3'> |
| <script type='text/javascript'> |
| fn1(); |
| fn3(); |
| </script> |
| </body> |
| </html> |
