Vic clicks on the link. The page renders the search parameter in the HTML without escaping it properly, which creates a new <script> tag in the browser.
<script>