Resident Script via createElement Object Self-Pointer

Creating an <object type="text/html"> element and storing a self-referencing pointer from the object’s window back to the element itself keeps the object alive even after the parent navigates away. The trick requires IE8 emulation mode to allow the element to be created via createElement with an HTML string, and the self-pointer prevents garbage collection.

function main() {
    obj = document.createElement('<object type="text/html" data="resident.html"></object>');
    setTimeout('obj.object.obj = obj; location = "http://www.bing.com";', 1000);
}

After obj.object.obj = obj creates a circular reference, the page navigates to Bing. The object remains in memory and resident.html continues to run — showing an alert a couple of seconds after Bing loads. The IE8 document mode (X-UA-Compatible: IE=EmulateIE8 in the page header) is what allows the createElement call with an HTML tag string. Tested on IE10 / IE11 build 20130227-2100.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.