<iframe
 id="test"
 src="http://html5sec.org/xssme?xss=%20href=javascript:alert(location.host)%20x="
 sandbox
style="width: 100%; height: 100%;"></iframe>

<script>
 var iframe = document.getElementById('test');
 iframe.addEventListener('load', function() {
  iframe.sandbox = 'allow-scripts';
 });
</script>