IE10 Address Bar Spoof via history.pushState and Reload

The history.pushState API in IE10 Preview 3 did not always refresh the address bar correctly when navigating back and forth. By pushing a redirect URL into the history and immediately reloading, the browser would land on the target site while the address bar could be made to show a different URL after pressing the back button.

<script>
function main()
{
    history.pushState("", "", "redir.aspx");
    location.reload(); // loads the last item in history (redir.aspx, which redirects to another site)
}
</script>
<input type="button" onclick="main()" value="Do it!" />

After the redirect completed and Bing (or any target) was showing, pressing the back button caused the address bar URL to update incorrectly — displaying a URL that did not match the page content. This could be combined with resident-script techniques to make the entire flow automatic without requiring user interaction.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.