Consider this code:

PHP Code:
<?php

echo $_SERVER['HTTP_USER_AGENT'];

?> 
Are there any simple means of exploiting this via XSS w/ Javascript? I'm looking for some neat javascript that would prove it... any help would be appreciated. I've been looking at Javascripts that can make GETs, but I need a simple method to forge HTTP headers, which I've been unable to find.

Thanks!

edit:
In this case, the user agent is not stored in any database, meaning the victim's UA would have to be spoofed somehow, probably w/ javascript.