I stored an expression in the URL fragment/hash, loaded it from there and eval-ed it. The hash symbol would break the expression, so it needs to be removed or commented out. Removing it by string manipulation would have exceeded the 32 character limit, so I went with commenting it out. That means you need to start any expression with "* /" (remove the space) to close the comment around the hash symbol.

The hover text of the example link gives you a good idea of what is happening.

Have fun!

Random animation, 47 characters payload:

https://tixy.land/?code=eval(%27%2F*%27%2Bparent.location.ha...