innerHTML=location.hash>#<script

Short Description:

<script>alert(1)</script>

Full Description