I think I broke it

[Citizen Bleys]

<div ="window.location =http://www.google.ca">
This is not why HTML should not be enabled in forums. I'll show you in a bit, but I need to get the post id for this post first otherwise the damage I do to this thread will be irrevocable.</div>

EDIT: nicely done -- as long as you can predict the moves of every malicious script kiddie on the internet like that and find out about new additions to dhtml/javascript before the bad guys do.