title: Is Javascript/jQuery DOM creation safe until it's added to the document?
body: <p><strong>Please read this statement carefully:</strong> let's assume before ANY elements are added to the <code>document</code> <strong>all</strong> unsafe elements in $dom have been removed. But they were initially created. Ok let's continue....</p>
  <hr />
  <p>If a piece of user text is processed and can possiblity be loaded like so:</p>
  <pre><code>var comment = 'I\'m a naughty person!!' +
                '&lt;script src=&quot;http://blah.com/some_naughty_javascript.js&quot;&gt;';
  var $dom = $('&lt;div&gt;' + comment + '&lt;/div&gt;');
  </code></pre>
  <p>Is this <strong>by itself</strong> dangerous in any way? My point being, can just the simple act of creating a DOM somehow inject anything, or is it just simply processed and the structure is created?</p>
  <p><strong>For example:</strong></p>
  <pre><code>var $dom = $('&lt;script&gt;alert(&quot;hi&quot;);&lt;/script&gt;');
  </code></pre>
  <p>Obviously the message hi does not pop up until it's added to the <code>document</code>. But:</p>
  <ul>
  <li>Can any tag or anything created in this manner be dangerous?</li>
  <li>Can any functions in javascript/jquery &quot;watch&quot; for elements being created in this manner and act on it BEFORE it's been stripped of bad elements and put on document?</li>
  </ul>
  <hr />
  <h2>Bounty Edit</h2>
  <p>So as outlined in the answers below, it seems this method isn't very safe, particularly for one reason:</p>
  <ul>
  <li><code>var $dom = $('&lt;img src=&quot;blah.jpg&quot;/&gt;')</code> -- this will request for the image straight away, regardless of if the object was added to the document.</li>
  </ul>
  <p>This creates a major problem for dealing with HTML ajax requests. For example if we wanted to get the values from the inputs of the form:</p>
  <pre><code>$.ajax({
    url: 'test.php',
    success: function(responseHTML) {
      var inputs = $(responseHTML).find('form input');
    }
  });
  </code></pre>
  <p>This will involuntarily cause all images to be requested for by the browser.</p>
  <p><strong>Bounty is awarded to anyone</strong>:</p>
  <ul>
  <li>Who can provide a nice, safe way of dealing with ajax requests without the above issue.</li>
  <li>Ideally doesn't provide a regex answer... i.e. what if we wanted to do <code>$(responseHTML).find('img')</code> -- removing image tags with regex can't be an option, so an unobtrusive way would be needed to stop the src from loading, but still have the same attributes, structure, etc.</li>
  </ul>