Note that re-downloading the source prevents this attack, but does not mean that the source you are looking at is what the page is actually running - just make the web server leave out the reference to evil.js the second time an IP address requests the page...