<img src='invalid_link.png' onerror="this.src='alert(1);'">
<img src="foo" onMouseOver="alert(33);"
I'm sure that's where most people are getting it from.
<img src='invalid_link.png' onerror="this.src='alert(1);'">