If endianness is working you should see the Devanagari Om: ॐ

If UTF-16 surrogates are working (and you have proper fonts installed) you should see the monogram for Earth (three dashes): 𝌀

Testing BOM and ZWNBS in WebKit products like Apple Safari

The following demonstrates how a Unicode BOM gets ignored in WebKit products. Most likely, the Unicode parsing is dropping the BOM character before handing it to the HTML and javascript parsers. Expected behavior would be to throw an error.

In the following test, we have U+FEFF embedded throughout the HTML markup and javascript. It's pretty nasty, looks like:

<a h[U+FEFF]ref="javas[U+FEFF]cript[U+FEFF](ale[U+FEFF]rt('onclick')">

test BOM U+FEFF // This exploits in Safari