If you know the concept of "overloading" something, think about it. The browser is designed to check the string that you put in the address bar (or pass it as href), and if it starts with the string literal "javascript:", it knows how to execute javascript, and not treat it as a URL,
source
share