in the chooseTab function you have the following line:
html += "<img src='/static/level3/cloud" + num + ".jpg' />";
the src opens with a single quote and looks for the 'num' var. So instead of num in the URL, you close the single quote and then close the image tag, and then run your script.
The real problem is the substring(1) function which passes the "num", instead of making sure the length is 1 it is allowing everything.