Instead of "onclick" for the <img> tags, you can bypass the required user interaction and be more brutal using "onerror" e.g. <img onerror="alert('hacked')" url="broken_url">.