Staying Resident via a Cached Flash IFrame Document

While poking at how IE handled documents inside Flash-embedded iFrames, I noticed that grabbing a pointer to the document before navigating away kept some very lively references around. Setting a timer through that stale document let JavaScript continue running long after the page had moved on.

<iframe name="swfIFrame" src="something.swf" width="1" height="1"></iframe>

pDocument = window[0].document.all.swfIFrame.Document;
window[0].location = "about:blank";
pDocument.parentWindow.setInterval("alert('I am here!')", 3000);
location.replace("http://www.google.com");

Navigating the main window away did not kill the interval: the cached document reference kept the scripting engine alive and running in the context of the new page. It was a good reminder that reference counting and lifetime management in the COM-heavy IE architecture could leave unexpected handles open when plugin documents were involved.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.