Staying Resident via a Destroyed HTML Object

Similar in spirit to the Flash IFrame residency bug from a few weeks earlier, this one used an HTML Object element instead. By saving a pointer to a member on the object’s window before destroying the element, and then setting a timer interval, I could keep code running well after the page had navigated away.

pHtmlWindow.self_pointer = pHtmlElement;
pHtmlElement.outerHTML = 'BYE_BYE_OBJECT';
pHtmlWindow.setInterval("alert('I am Here')", 3000);
location.replace("http://www.google.com");

The key step was attaching a property (self_pointer) to the object’s window before destroying the element. This created a circular reference that prevented the window from being garbage collected. Setting the interval through that window handle kept the script alive indefinitely, even as the browser navigated to an entirely different page.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.