The provided example has two problems:

• Inclusion of raw <script>…</script> breaks the resultant HTML
• element[attribute='<script>alert(1);</script><img src='sss' onerror='alert(1)'><b>zzz</b>'] is not a valid selector (the string against which to test "attribute" is closed immediately before "sss")

Fixing both problems demonstrates the lack of a vulnerability: http://jsfiddle.net/C8dgG/28/

However, fixing just the first reveals a parsing error in Sizzle: http://jsfiddle.net/C8dgG/29/

I will open a new ticket for the latter.