This will fail on input like `"<img src='/path/to/src' onload='finished(this)' data-onload='true'/>"` (attribute collision) or `"Example vulnerability: <pre><img onerror='alert(\"Pwned!\")'/></pre>"` (content alteration). I think consistency trumps security here, and we have to reject this approach.