Is window.location = window.location susceptible to XSS
<p>This question is relating to the code <code>window.location = window.location</code> as a method to refresh the page and is not concerned with redirections / other variables. </p>

<p>My understanding is as follows: </p>

<p><code>window.location = window.location</code> causes the page to refresh, as the browser will navigate to the same location the user is already on. </p>

<p>Any change to this variable via DOM manipulation will cause the page to reload/load the attackers page, thus these lines will not able to be executed with an altered value and so are not a candidates for cross site scripting attacks. </p>

<p><strong>Is this correct?</strong></p>

<p><strong>Edit:</strong> What I'm really asking is if there is a way to change <code>window.location</code> without causing a page reload, so that then when the <code>window.location = window.location</code> call is made, the browser will be sent to another location. </p>