{ alert('before'); document['stevey'].src='http://www.steve.org.uk/Hacks/xss-snapshot.jpg'; alert('after');}; foo();)
If you're vulnerable you'll see two alert boxes, and an image will appear in this window.
(The image was the very first one that I ever took with my webcam a good few years back!)
Update: 00:05AM 9/Sep/09 - <INPUT TYPE="IMAGE" SRC="javascipt:"> works just the same.