[there]

that weird behavior of javascript can actually be used for xss attacks, by being able to assemble strings. for example:

   (![]+[])[+!+[]]

produces an "a".

https://news.ycombinator.com/item?id=1153383

[jrockway]

But of course, anyone that actually wants to protect against XSS attacks won't allow user input to be evaluated. If they did want to allow user-supplied Javascript, they wouldn't blacklist, they would whitelist (by parsing the user-supplied script and using the AST to emit only whitelisted operations).