NetSuite just pastes whatever you set a field to without any sanitizing (very vulnerable to XSS etc. attacks but that's a different discussion..). So just set a field value to

<script>alert('Hey!')</script>

and it should popup when you open the page