Mutation XSS was coined by me and Mario Heiderich to describe an XSS vector that is mutated from a safe state into an unsafe unfiltered state. The most common form of mXSS is from incorrect reads of innerHTML. A good example of mXSS was discovered by Mario where the listing element mutated its contents to execute XSS.
more here.......http://www.thespanner.co.uk/2014/05/06/mxss/
more here.......http://www.thespanner.co.uk/2014/05/06/mxss/