Corruption of invalid bytes:
<scr�ipt>alert("xss");<scr�ipt>

Not Sure:
<����	��>alert("xss");</����	��>

Over long UTF-8:
��script��alert("xss");��/script��

MS00-057: 
..��..��..��..��