I've compiled some examples of real-world functionality I've encountered that can be used to bypass Internet Explorer's (as well as "Spartan"/"Edge"'s) anti-Reflective Cross Site Scripting filter.
Play around with the deliberately vulnerable pages, and see for yourself how you can chain together a site's own functionality to reproduce the bypass.
.html to any
.php extension to see the source of the
With the MS14-080 update, using two of the following pages has become slightly more difficult, but still possible. Those two page are marked with an * character.
The main playground equipment: