This vector uses Shazzer's new features to check which entities are allowed inside a function name using images. The results are a bit inconsistent yet because I currently wait for page load.
<img src=data: onerror="lo$[data1]g('html($[data1])')">Chrome 151.0.7922.110 ran this vector and matched nothing.
Firefox 153.0 ran this vector and matched nothing.
Microsoft Edge 146.0.0.0 ran this vector and matched nothing.