There is no XSS in the pasted code. This is only setting the hash of the URL
location object. XSS can only occur when something in an HTML document is set without proper encoding.
Note that this answer is based on the posted code only, and no assumptions are made about where the hash is later used. If the use of the hash gives rise to a vulnerability, the vulnerability lies here than rather with the posted code.
The reason for this is that the application is then processing user input as though it is trusted. If the above code could create a dangerous hash, then an attacker could also create the dangerous hash without using the posted code in exactly the same way as a reflected XSS attack works. e.g. the attacker gets the user to visit a specially crafted URL like
to trigger the attack. It is upto the hash processing code to deal with this, not the code that generates the hash.