vf

  function doBadThings() {
// much more damaging scripts can be defined here, for
// demo purposes, we will just have an alert statement
    alert('XSS');
  }
  doBadThings();