This tests that javascript: urls in an object tag do not get executed.