add another example of bogus sillyness in innerHTML

git-svn-id: http://svn.whatwg.org/webapps@139 340c8d12-0b0e-0410-8428-c7bf67bfef74

index

@@ -2244,7 +2244,10 @@ and suggestions on this to the list, btw).
    DOM manipulation, the element contains a comment that contains the literal
    string "<code title="">--&gt;</code>", then when the result of serialising
    the element is parsed, the comment will be truncated at that point and the
-   rest of the comment will be interpreted as markup.
+   rest of the comment will be interpreted as markup. Another example would
+   be making a <code><a href="#script2">script</a></code> element contain a
+   text node with the text string "<code>&lt;/</code>", or even worse,
+   "<code>&lt;/script></code>".
 
   <p>On setting, the <code title="dom-innerHTML-HTML"><a
    href="#innerhtml">innerHTML</a></code> DOM attribute must run the

source

@@ -1309,7 +1309,10 @@ and suggestions on this to the list, btw).
   contains a comment that contains the literal string "<code
   title="">--&gt;</code>", then when the result of serialising the
   element is parsed, the comment will be truncated at that point and
-  the rest of the comment will be interpreted as markup.</p>
+  the rest of the comment will be interpreted as markup. Another
+  example would be making a <code>script</code> element contain a text
+  node with the text string "<code>&lt;/</code>", or even worse,
+  "<code>&lt;/script></code>".</p>
 
   <p>On setting, the <code title="dom-innerHTML-HTML">innerHTML</code>
   DOM attribute must run the following algorithm:</p>