Deja Vu. I had to submit an issue and fix a similar issue -- it was similarly Twitch chat overlay XSS, but for that they at least tried to strip the tags (but it was a poor JS implementation of PHP strip_tags), and didn't understand the issue until I crafted a image with onload/onerror to freeze/hang the chat overlay.