Okay this is kinda useless because there are soooo many cases of possible XSS attack vectors and you can't really test it without checking for an alert or so, but nice to have :)