The idea is to craft a link to `javascript:`

See the original writeup for more