Problem author's writeup.

Summary: post a JS/WAVE polyglot with a .wave extension and XSS via the description field