Internet Explorer & "Spartan"/"Edge" XSS Filter Bypass Playgound

Welcome to The Playground.

With the release of MS15-065, most of these no longer work, however I am keeping this open and available for historical purposes.

I've compiled some examples of real-world functionality I've encountered that can be used to bypass Internet Explorer's (as well as "Spartan"/"Edge"'s) anti-Reflective Cross Site Scripting filter.
Play around with the deliberately vulnerable pages, and see for yourself how you can chain together a site's own functionality to reproduce the bypass.
Append .html to any .php extension to see the source of the .php file.
Example:

playgoundIframeInject.php
playgoundIframeInject.php.html

With the MS14-080 update, using two of the following pages has become slightly more difficult, but still possible. Those two page are marked with an * character.

The main playground equipment:

Inject into a <frame> element.
Inject into an <iframe> element.
Inject into a <form> element.
Inject into an <input> element's value attribute in a form.
Inject into an <input> element's name attribute in a form.
Inject into an anchor element.
Inject into an anchor tag, all characters are reflected exactly without URL/URI decoding.
Inject directly onto the page. *
Inject directly onto the page, however all alphabet characters are capitalized. *
Inject into a <link> tag within the <head> element.
Inject into a JavaScript redirect to any of the above pages. Not fixed by MS15-065: still vulnerable as of August 22^nd, 2015

Additional playground equipment:

Going to this page will set a cookie that can be used for testing cookie grabbing JavaScript code.
This page has some fake sensitive information (CSRF token in a hidden field, fake user data, etc.) that can be used for testing web page parsing JavaScript code.
All HTML elements have unique IDs for testing web page manipulation JavaScript code (eg: document.getElementById('something').doStuff();).
A fake login page for testing key-capturing or form submission value capturing JavaScript code.