This is a creative hack, and here’s where it actually matters. Blocklist-based sanitizers and WAFs typically work by matching a string or a regex, so this type of hack usually slips past them. I found this class of XSS in audits in telemetry fields that were protected by a regex blocklist. The actual fix was not just a longer blocklist, but context-aware output encoding (plus a CSP as defense in depth).