Create a user with alias "<script>alert('test')</script>". Go to the Administration -> Notifications page, an alert will be displayed there.

This needs to be checked and fixed in all releases starting from 1.8.