Views field rewrite onClick attribute not rendering
Views rewrite uses the filter_xss_admin function to produce safe html. It's designed as a security measure and is in place even if the user has permissions to add PHP and unfiltered HTML in other contexts.

You can work around by using Views PHP for example. See this issue at drupal.org for discussion and more on workaround approaches.