You can do much better than that onerror exploit if the site supports arbitrary <img src> attributes, even if they filter everything correctly otherwise.

In IE6, and older versions of Opera, <img src=target> is identical to <script src=target> if it sniffs the content of the response from the target to be javascript. Really.