The issues Sebastian, et al. have collated at http://sebastian-lekies.de/csp/bypasses.php are super-interesting. Some of them seem like bugs in the browser, others might require tweaks to parsing, etc.

This is a wrapper bug for the things we'll experiment with to address them.