Reflected XSS with AngularJS sandbox escape without strings