INTIGRITI 'Unknown': Bleach Bypass, CSPT, and an Open Redirect Walk Into a Bar

How I chained a bleach bypass, client-side path traversal, and an open redirect to steal cookies through an outerHTML sink.