One extra ampersand in code leads to IE8 exploit
arstechnica.com