Dropping the URL of the "profile image" in the browser address bar causes the script to be executed.
What is your bidding?