https://code.google.com/p/snuck/

"Snuck's goal is to significantly test a given XSS filter by specializing the injections on the basis of the reflection context."

​