In IE10 I've disabled JS execution by setting maximum security level (IE11 also affected).
Then I add or edit onmousedown attribute on any element on any site (for example, body element on www.google.com).
<body onmousedown="alert('Hello')">...</body>
And so I get an alert when clicking anywhere.
Is it expected behavior or bug?