In Materialize up to and including 1.0.0, XSS is possible via the Toast feature.
materializecss materialize