The Windows Media Player ActiveX control had two ways to open a URL that both bypassed IE’s popup blocker: a scriptcommand embedded inside a WMV file, and the launchURL method called directly from script. Neither path required any user interaction beyond the page load, and the popup blocker did not intervene.

<object id="oWMP" classid="clsid:6BF52A52-394A-11d3-B153-00C04F79FAA6" width="200" height="100">
    <param name="URL" value="wmv_with_script.wmv">
    <param name="autoStart" value="1">
</object>

<script>
oWMP.launchURL("http://www.google.com");
</script>

The wmv_with_script.wmv file contains an embedded scriptcommand that opens a URL when the media plays. The launchURL call in the script tag fires immediately on page load and also opens a window without triggering the blocker. This was tracked as Windows OS Bugs #1528646.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.