This entry contains compiled artifacts (.zip archives of the PoC files). The techniques involved creating popups that “stick” to the screen or cover it even after navigation — exploiting IE6’s handling of createPopup during unload events. One variation would also crash IE6 when the popup attempted to interact with a destroyed parent frame during the unload sequence.
The sticky popup technique worked by creating a createPopup() inside an onbeforeunload or onunload handler, giving it a size large enough to cover most of the screen, and keeping a self-reference alive so it would persist. The cover variant used positioning to ensure the popup filled the viewport regardless of scroll position.
Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.