As before, using <script> ... as a payload won't work
because the browser won't execute scripts added after the
page has loaded.
This is the URL I used:
https://xss-game.appspot.com/level3/frame#'><script>alert('bla')</script>
https://xss-game.appspot.com/level3/frame#' onerror="alert('bla')">
the src opens with a single quote and looks for the 'num' var. So instead of num in the URL, you close the single quote and then close the image tag, and then run your script.
The real problem is the substring(1) function which passes the "num", instead of making sure the length is 1 it is allowing everything.