How does a browser render this inline JavaScript within an encoded tag?

Question 1

When an HTML page says &#60body It treats it the same as if it said <body

That is, it just displays the encoded characters, doesn't parse them as HTML. So you're not creating a new tag with onload attributes http://jsfiddle.net/SSfNw/1/

alert(document.body.innerHTML);
// When an HTML page says &lt;body It treats it the same as if it said &lt;body

So in your case, you're never creating a body tag, just content that ends up getting moved into the body tag http://jsfiddle.net/SSfNw/2/

alert(document.body.innerHTML)
// &lt;body onload="alert('Hi')"&gt;&lt;/body&gt;

In the case <body onload="&#97lert('Hi')"></body>, the parser is able to create the body tag, once within the body tag, it's also able to create the onload attribute. Once within the attribute, everything gets parsed as a string.

Question 2

I can't come up with words to describe the properly, so i'll just give you an example. Lets say we have this string:

<div>Hello World! &lt;span id="foo"&gt;Foobar&lt;/span&gt;</div>

When this gets parsed, you end up with a div element that contains the text:

Hello World! <span id="foo">Foobar</span>

Note, while there is something that looks like html inside the text, it is still just text, not html. For that text to become html, it would have to be parsed again.

Attributes work a little bit differently, html entities in attributes do get parsed the first time.

tl;dr:

if the service you are using is stripping out tags, there's nothing you can do about it unless the script is poorly written in a way that results in the string getting parsed twice.

Demo: http://jsfiddle.net/W6UhU/ note how after setting the div's inner html equal to it's inner text, the span becomes an html element rather than a string.