DOM XSS in jQuery selector sink using a hashchange event