CONSOLE MESSAGE: line 9: TypeError: 'null' is not an object (evaluating 'document.getElementById("target").src = "javascript:alert('FAIL')"')
This tests that javascript: urls in an embed tag do not get executed.