[olefoo]

Well the demo apparently doesn't sanitize the name field in messages it receives.

Because there is some quality XSS happening.

[pas256]

Thanks to phibit, that is now fixed