does creating the element from an html string w/o an inline event handler work? the point is, if doing it the wrong way is unsafe, we should explcitly make the point that doing it the insecure way is actually the *wrong* way for the web too!!