**Do you want to request a feature or report a bug?**
Report a bug

**What is the current behavior?**
It's possible to execute JavaScript code written in the child parameter of the `React.createElement` function, if the type parameter consists of a string with mixed casing, like so:

```javascript
React.createElement('scRipt', null, 'alert(1)');
```
https://codesandbox.io/s/sleepy-hodgkin-twxqe

**What is the expected behavior?**
It should not execute the code, but behave exactly like if you typed in 'script' in lowercase.

I would argue that this is unexpected behavior. Judging from the docs (["JSX Prevents Injection Attacks"](https://reactjs.org/docs/introducing-jsx.html#jsx-prevents-injection-attacks)) developers might get the impression, that it is generally safe to embed any user input using JSX. Additionally, if you try to execute JavaScript using script tags, it won't work. 

I _think_ developers might get the idea to give users the ability to write their own "safe" HTML code in comments and the like by parsing their input and converting it to React elements. JSX also allows you to use dynamic input as tag types.

Apart from the mentioned behavior, I'm not aware of any other `type` / `children` combination that would result in JavaScript code execution without a controllable props parameter. So a scenario where a user can control both of these parameters is most likely the only one where this leads to issues.

So I think the code below is likely the culprit (line 423). Please correct me if I'm wrong.

https://github.com/facebook/react/blob/fce15f14d38d680f3bdee3a124e9e94e91520e16/packages/react-dom/src/client/ReactDOMComponent.js#L423-L430

Imo it would make sense to convert the `type` variable to lowercase before comparing it to the 'script' string, so it works as anticipated, even if the casing of the input is user-controllable. Unfortunately I'm not familiar enough with the inner workings of React to submit a pull request of which I'm confident, that it doesn't break anything. This would be my naive solution for this issue:

```javascript
if (typeof type === 'string' && type.toLowerCase() === 'script') { /* ... */ }
```

I'd love to hear your thoughts on this. Is this behavior actually unexpected and if so, should it be fixed?
track((domElement: any));
      ReactDOMTextareaPostMountWrapper(domElement, rawProps);
      break;
    case 'select':
    case 'option':
      
      
      
      
      
      break;
    default:
      if (typeof rawProps.onClick === 'function') {
        
        trapClickOnNonInteractiveElement(((domElement: any): HTMLElement));
      }
      break;
  }
  return updatePayload;
}
export function diffHydratedText(textNode: Text, text: string): boolean {
  const isDifferent = textNode.nodeValue !== text;
  return isDifferent;
}
export function warnForUnmatchedText(textNode: Text, text: string) {
  if (__DEV__) {
    warnForTextDifference(textNode.nodeValue, text);
  }
}
export function warnForDeletedHydratableElement(