Ah there's the inevitable alert("test") messages. Thank god for the 'prevent this window from generating additional popups' option in browsers these days.
Without looking into the source, I'd bet someone tweeted the "exploit", just to make the point that going to that page basically runs arbitrary javascript in your browser.
Makes me want to learn d3 finally.