[variable-reference-name-substitution-attr-taint.html]
  [attr()-tainted name argument does not invalidate values that are not URLs]
    expected: FAIL

  [attr()-tainted name argument substitutes normally into a custom property]
    expected: FAIL

  [untainted substituted name argument does not taint the value]
    expected: FAIL