Exercises document.evaluate() with tainted XPath expressions from the full portal rulepack.
document.evaluate()