title: IE10 with disabled JS executes manually entered `onmousedown`
body: <p>In IE10 I've disabled JS execution by setting maximum security level (IE11 also affected).</p>
  
  <p>Then I add or edit <code>onmousedown</code> attribute on any element on any site (for example, <code>body</code> element on <code>www.google.com</code>).</p>
  
  <pre class="lang-html prettyprint-override"><code>&lt;body onmousedown="alert('Hello')"&gt;...&lt;/body&gt;
  </code></pre>
  
  <p>And so I get an alert when clicking anywhere.</p>
  
  <p>Is it expected behavior or bug?</p>