Ned Batchelder: Xss with utf-7
http://www.nedbatchelder.com/blog/20070421T080434.html
"The resulting page doesn't have any explicit declaration of its character set, so depending on your browser settings, the browser may try to auto-detect the character set, and seeing the distinctive UTF-7 byte sequences, will choose UTF-7. In UTF-7, the