As we know, developers are responsible for correctly escaping/validating data provided by the user before rendering or storing them. However, we must agree that it's relatively easy to forget a single input among hundreds, and finally get your web-app exploited by a XSS. Or haven't you met someone that got his/her site exploited by XSS?
Even Twitter and Orkut recently suffered from XSS. And I'm not here to blame anyone.
This doesn't solve the problem of rendering
<script> tags in the middle of a DOM tree, but this is much easier to solve, I suppose.
Besides my previous point, what kind of problems or flaws do you see in the described solution?
UPDATE 1: only the head element should be trusted to invoke
UPDATE 2: hopefully, the following snippet explains my idea a bit further:
This should NOT allow execution of:
alert('inner')-> we allow
div.outer, but none of its child elements;
alert('example 1')-> we allow
#list, but none of its child elements;
alert('a')-> we allow