Alternatively, you can just make sure that your javascript: URL ends up with an undefined value:
javascript:window.onclick=function(){alert('hi');},undefined
The semantics of a javascript: URL are that the result of evaluating whatever's after the : is taken to be the URL to load, unless the result is undefined. The IIFE in Mr. Sampson's answer accomplishes that, but so does anything that leaves the result of expression evaluation undefined, as the comma-operator example above does.
It's a good idea to make sure that your javascript: URL (or bookmarklet, which is kind-of what we're talking about) is URL-encoded, though browsers are usually pretty tolerant in the URL bar. If you want to save the URL as a bookmark, I've always encoded it.