img is not an innocent tag. it has scriptoid attributes. like onerror=.