I wonder if someone could set their name to like

bob/picture/fail" onerror="alert('xss')

and xss