<a onload="doevil()">clickme</script>