That's the same 'attack' you could make on https://jsfiddle.net

What I am getting at is that you can't form a url that will do this, you need to interact with the page to trigger it.