The message is created, but clicking on the message does not render the content. The attack can't fire without the content being rendered. The Message should show below the message list with a line separator.

This is from Firefox, Chrome, and Safari