Characters allowed to break double quotes in the action attribute
<form id="test" action="aaa$[chr]onsubmit=alert(1)><input/type='submit'>0x0D
var form = document.getElementById("test");0x0D
if (typeof form.onsubmit === 'function') {0x0D
log(String.fromCharCode($[i]))0x0D
}<form id="test" action="aaa0x00onsubmit=alert(1)><input/type='submit'>0x0D