Pop-up Blocker Bypass via Windows Media Player 12

The launchURL method of the Windows Media Player 12 ActiveX object bypasses IE’s pop-up blocker on Windows 7. The same method with WMP 11 on XP/Vista did not reproduce, suggesting a regression introduced in WMP 12.

<object id="oWMP" classid="clsid:6BF52A52-394A-11d3-B153-00C04F79FAA6"
        width="1" height="1"></object>

<script language="JavaScript">
setTimeout('document.getElementById("oWMP").launchURL("http://www.google.com");',2000);
</script>

This was a very old bypass method that had been patched in earlier WMP versions. Tested on Windows 7 RC Build 7100 with IE8.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.