Fix bug 901819 - Prevent DOM XSS using document.hash