Bug 865947 - Force all string event handlers to be evaluated in the content scope. r=jaws,bz

layout/style/xbl-marquee/xbl-marquee.xml

@@ -259,7 +259,7 @@
             case "string":
               if (!aIgnoreNextCall) {
                 try {
-                  this["_on" + aName] = new Function("event", aValue);
+                  this["_on" + aName] = new XPCNativeWrapper.unwrap(window).Function("event", aValue);
                 }
                 catch(e) {
                   return false;