validator, but could lead to script execution
       depending on the value. -->
  <a href="{{foo}}"></a>
  <a href="java{{foo}}script:alert('foo')"></a>

  <!-- Really tricky example that the validator allows, but the runtime
       must handle. Essentially if {{foo}} is an empty string, this becomes
       a <script> tag, otherwise, it's just a harmless comment -->
  <!-- comment --{{foo}}><script><!-- -->

</template>

<template type="amp-mustache">
  <div>
    <template type="amp-mustache">
      Nested